CI: upload Scorecard SARIF to Code Scanning

[the-sarge]

What to build

From the 2026-05-27 multi-agent code review (item H6.b; tracked as F3 in docs/code-review-followups-2026-05-28.md).

The Scorecard workflow runs with results_format: json and publish_results: true but never uploads SARIF to Code Scanning, never stores the JSON as a workflow artifact, and never fails on findings. Findings are visible only on the externally hosted OpenSSF page, not in the repo's own Code Scanning tab.

Switch the workflow to results_format: sarif and upload the results via SHA-pinned github/codeql-action/upload-sarif (reuse the same version pin as sast-gate.yml), with security-events: write granted at job level. Follow the upstream ossf/scorecard-action README pattern.

Acceptance criteria

• results_format switched to sarif
• SARIF uploaded via SHA-pinned github/codeql-action/upload-sarif, same pin as sast-gate.yml
• Job-level permissions include security-events: write (and remain least-privilege otherwise)
• Scorecard findings appear in the repo Code Scanning tab after a run on main

Blocked by

None - can start immediately