Automate Charter score badge refresh in generated GitHub workflow

[stackbilt-admin]

Problem

Repos onboarded with Charter can generate a score badge via charter score --badge --write, but the generated charter setup --ci github workflow does not currently keep .charter/badge.json fresh. Users reasonably expect the README badge to update automatically after Charter/ADF/governance changes land.

Expected behavior

Repos using the generated GitHub workflow should automatically refresh .charter/badge.json on default-branch pushes, and commit the file only when the payload changed.

Proposed acceptance criteria

• Generated .github/workflows/charter-governance.yml runs on pushes to main/master as well as PRs.
• Push/default-branch runs execute charter score --badge --write.
• The workflow commits .charter/badge.json only when changed.
• Bot commits include governance metadata so charter validate --ci does not fail on the follow-up badge commit.
• PR runs remain useful as validation checks and do not try to write badge commits.
• Docs explain that Shields renders from the committed JSON, while the generated workflow refreshes that JSON.

Evidence

Current docs expose the manual command and README snippet, but the generated workflow template only runs validate, drift, ADF doctor/evidence, and audit. There is no generated badge refresh/commit step today.