ci(scorecard): drop SCORECARD_TOKEN — let Branch-Protection go inconclusive

Passing repo_token unlocked the Branch-Protection check, but our branch
protection is intentionally weak (solo maintainer, no required approvals,
enforce_admins:false to keep auto-merge-on-green working) so it only scores
~4. OSSF aggregates by mean and OMITS inconclusive (-1) checks while
INCLUDING scored ones — so folding a 4 into otherwise ~7 checks drags the
aggregate down (observed 6.9->6.7 when the token was added; now 7.2 with
BP=4 included). Removing the token reverts Branch-Protection to inconclusive
(the default state for any repo that doesn't grant Scorecard a privileged
PAT), so it stops counting and the aggregate should rise (~7.5).

Not strengthening branch protection instead: enforce_admins:true would block
admin merges and break the auto-merge flow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: blove

.github/workflows/scorecard.yml

@@ -28,10 +28,6 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
-          # Read-only PAT (Administration: read) so Scorecard can evaluate the
-          # Branch-Protection check, which the default GITHUB_TOKEN cannot read.
-          # Falls back gracefully (check stays inconclusive) if the secret is unset.
-          repo_token: ${{ secrets.SCORECARD_TOKEN }}
           publish_results: true
       - name: Upload artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2