chore: add OpenSSF readiness baseline

[seonghobae]

Summary

• add missing OpenSSF Scorecard workflow/security/dependency metadata where needed
• enable repository-level OSSF Best Practices prerequisites without changing product code
• keep existing source code and CI implementation unchanged

Notes

This PR is part of the ContextualWisdomLab non-fork repository OpenSSF readiness sweep. Public repositories will be registered on bestpractices.dev after the baseline metadata is available on the default branch.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 89c2acc20d547c1317a624d24c26bda5e8dc34ca
• Workflow run: 28380021496
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

GitHub[\"Private Reporting\"] --> Maintainers[\"Response Workflow\"], PoC/execution: Verified policy content against GitHub docs, DDD/domain: Security compliance, CDD/context: Matches repository security needs, Similar issues: Standard OSS practice, Claim/concept check: Valid, Standards search: Matches GitHub security guidelines, Compatibility/convention: Consistent with OSSF best practices, Breaking-change/backcompat: N/A, Performance: N/A, Developer experience: Clear reporting instructions, User experience: Improved security handling\n\nVerification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including SECURITY.md.\nLinter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.\nTDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.\nCoverage: coverage execution evidence reports test coverage as not applicable because no supported changed source files or package manifests were found.\nDocstring coverage: coverage execution evidence reports docstring coverage as not applicable because no supported changed source files or package manifests were found.\nDAG: Change Flow DAG maps SECURITY.md through bounded evidence, review risk, and required checks.\nPoC/execution: coverage-evidence job executed on the current head and reported PASS.\nDDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.\nCDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.\nSimilar issues: changed-file history evidence was reviewed for comparable local precedents.\nClaim/concept check: bounded evidence, repository source, and current-head workflow evidence were used for claims.\nStandards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.\nCompatibility/convention: changed workflow/script conventions and compatibility surfaces were checked in bounded evidence.\nBreaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.\nPerformance: changed surfaces were checked for performance risk in bounded evidence.\nDeveloper experience: changed automation, review, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.\nUser experience: changed files did not identify a user-facing UI surface; bounded evidence was reviewed for UX impact.\nSecurity/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.","findings":[]}

-->

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: SECURITY.md"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: SECURITY.md"]
  R1 --> V1["required checks"]

Loading