chore(ci): make Scorecard periodic, not per-push (#34)

Makes the OpenSSF Scorecard workflow **periodic** by dropping its `push`
(and, in one repository, `pull_request`) trigger. `schedule`,
`workflow_dispatch` and `branch_protection_rule` are all kept.

**Why.** Scorecard measures the *repository's* supply-chain posture, not
the change under review. That is the `📅 PERIODIC:` tier in the estate's
signal-discipline standard: on a schedule against the default branch,
feeding a dashboard — not on every event. It cannot meaningfully pass or
fail a diff.

**Measured across 303 scorecard workflows before this sweep:**

```
199  push, schedule, workflow_dispatch
 93  branch_protection_rule, schedule, push
  1  push, pull_request, schedule, workflow_dispatch
  1  schedule, workflow_dispatch          <- the target shape
```

So ~292 repositories ran a full posture scan on **every push to the
default branch**. That is pure cost: the score cannot meaningfully
change between two consecutive merges.

**Deliberately kept:** `branch_protection_rule`. It fires on a settings
change — not per pull request — so it does not violate the PERIODIC
rule, and it re-measures precisely what Scorecard scores after exactly
the change most likely to alter it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -3,8 +3,6 @@
 name: OSSF Scorecard
 
 on:
-  push:
-    branches: [main, master]
   schedule:
     - cron: '0 4 * * *'
   workflow_dispatch: