ci: report OpenSSF Scorecard on pull requests (unblocks required status check)

[PeterGuy326]

Problem

Branch protection on main in this repository requires four status contexts (read live via GET /repos/bytefolk/design-system/branches/main/protection):

check
CodeQL (javascript-typescript)
Dependency review
OpenSSF Scorecard

The first three are produced on pull_request by .github/workflows/ci.yml and .github/workflows/bytefolk-security.yml, and are green on every current open PR.

OpenSSF Scorecard is not. It is emitted only by .github/workflows/bytefolk-scorecard.yml, whose trigger block is:

on:
  push:
    branches: [main]
  schedule:
    - cron: '43 3 * * 1'
  workflow_dispatch:

No pull_request trigger, so no pull request ever reports the context. Combined with enforce_admins: true, mergeStateStatus is permanently BLOCKED and not even an administrator can merge. Verified empirically against the head SHAs of the currently open PRs #22 and #23 — both report exactly four check runs (check, Dependency review, CodeQL (javascript-typescript), CodeQL) and no OpenSSF Scorecard.

Fix

Adds .github/workflows/scorecard-pr.yml, which runs Scorecard in local-checkout mode on pull_request and reports the required OpenSSF Scorecard job context.

Provenance: the file is byte-identical to the already-reviewed .github/workflows/scorecard-pr.yml on bytefolk/roleweave@main. Nothing has been authored or adapted here.

• sha256 e2e50885a6705e9095e99b1928212e853a9ba8489b7e6db0c085f5a28ddc8f44
• 1121 bytes

Self-unblocking

For pull_request events GitHub reads workflow definitions from the head branch, so this PR reports OpenSSF Scorecard on its own head. It can therefore be merged with no branch-protection change and no admin bypass.

Security notes

• permissions: contents: read only — no id-token: write, no security-events: write.
• publish_results: false — publication and the default-branch badge stay in bytefolk-scorecard.yml.
• Not pull_request_target; the job checks out the PR merge commit read-only.
• All actions remain SHA-pinned, matching the existing convention in this repository.

Scope

One new file added. No existing workflow, source file, or configuration is modified.

[Bindy-lbb]

正式复审通过（head fb1dbec）。

该 PR 只新增一个 SHA-pinned 的 Scorecard pull_request workflow：contents: read、不写 SARIF、不使用 pull_request_target，并保持默认分支的发布/徽章 workflow 不变。当前 check、CodeQL、Dependency review、OpenSSF Scorecard 均成功。批准合入。