docs: evaluate OpenSSF Scorecard adoption

[CoderDeltaLAN]

Summary

• Add a read-only OpenSSF Scorecard evaluation record.
• Document current official workflow constraints and repository-fit risks.
• Keep Scorecard workflow adoption deferred to a separate phase.

Boundaries

• No Scorecard workflow added in this PR.
• No README badge added.
• No branch protection, release, PyPI, CodeQL, Dependabot, or runtime behavior changes.
• No required status check changes.

Verification

• Local checks passed in a clean temporary development environment.
• Pre-push diff and content guards passed.
• No Scorecard workflow file exists in this evaluation phase.