ci: restore push-triggered Scorecard analysis on main

[seonghobae]

Why

All 6 open code scanning alerts in this repo (Scorecard rules BranchProtectionID #1, CodeReviewID #2, MaintainedID #3, CIIBestPracticesID #4, SASTID #5, CITestsID #28) live on refs/heads/main under analysis key .github/workflows/scorecard-analysis.yml:analysis. PR #14 deleted that workflow, orphaning the configuration: the central required workflows run Scorecard only on PR merge refs, so nothing ever re-analyzes main and those alerts can never refresh or close — even after the underlying check windows heal (SAST / CI-Tests / Code-Review recompute over the rolling last-30-commit window, Maintained clears at repo age 90 days).

What

Restores the pre-#14 .github/workflows/scorecard-analysis.yml verbatim. It triggers only on push: main and schedule — it never ran on pull requests, so it does not duplicate the central PR gates that motivated the removal in #14.

Effect

On merge, Scorecard re-analyzes main and the six alerts re-evaluate against current state instead of the 2026-07-12 snapshot; ones whose scores now pass close automatically, and the rest keep tracking reality per docs/scorecard-governance.md in ContextualWisdomLab/.github.

🤖 Generated with Claude Code

[opencode-agent]

Pull request overview

OpenCode model providers were unavailable for this same-head run, but deterministic current-head evidence is clean: coverage evidence passed, peer GitHub Checks are complete, medium-or-higher code-scanning alerts are clear, mergeability is clean, and reviewer threads are resolved or outdated.

Findings

No blocking findings.

Evidence

• Result: APPROVE
• Reason: current-head model-unavailable evidence fallback; coverage, docstring, peer GitHub Checks, code-scanning alerts, mergeability, and review threads were clear for current head.
• Scope: unsupported
• Changed files: 0
• Model-pool outcome: exhausted
• Head SHA: b27c922de11bb727d1aab678dc614f6788bd7269
• Workflow run: 29218899738
• Workflow attempt: 1

This fallback does not suppress failed checks, medium-or-higher code-scanning alerts, merge conflicts, unresolved reviewer threads, or failed coverage evidence; any of those conditions still publish REQUEST_CHANGES or leave the approval state unchanged.