feat(conformance): port external-grader cells — OpenSSF Scorecard, HSTS preload, SLSA build level

[bdelanghe]

Mirrors bounded-systems/lone#15 into the kit's vendored port — keeps the kit in lockstep with the source-of-truth standard.

What

Three new conformance criteria scored from independent third-party graders (independent by construction → no verifiedBy), all recommended (required: false, non-gating) — purely additive.

Cell	Evidence	met when
security.hsts-preload	hstsPreload.preloaded	on the Chromium HSTS preload list
integrity.scorecard	scorecard.score (0–10)	score ≥ 7.0
integrity.slsa-level	slsaLevel.level / .target	level ≥ target (default L3)

integrity.slsa-level is distinct from integrity.slsa-provenance (present/signed/verified).

Scope

CRITERIA entries + ENVELOPE fields + evaluators + shared SCORECARD_THRESHOLD + tests.

Verification

node test/run.mjs → 12 passed, 0 failed (the conformance projection's not-assessed count rises 24 → 27, confirming the three cells are wired). New assertions: absent → not-assessed; all three met with good evidence; all three unmet with failing evidence (HSTS false, Scorecard 6.9, SLSA L2 < L3).

Note: this repo's CI workflow (#4) isn't merged yet, so this PR shows "no checks reported" until that lands. Tests pass locally.

PR checklist

1. Independent PR — only the three external-grader cells (port of lone#15)
2. Changed codepaths verified — node test/run.mjs 12/0
3. Root cause / design — external graders are independent (no verifiedBy); non-gating to stay additive
4. No duplication — evaluators follow the existing pattern; one shared threshold constant
5. No unrelated changes — N/A

🤖 Generated with Claude Code