ci: scorecard comment says what the job token reads

[askalf]

From the 2026-09-25 audit of every action, item 24: the comment above repo_token says the Branch-Protection check "errors out (-1)" without a SCORECARD_TOKEN secret. It does not: no repo in the estate sets the secret, every run takes the github.token fallback, and Branch-Protection scores 5-8 from the public rules. The comment now says what the token can and cannot read. The expression is unchanged, so a PAT set later still takes precedence.

[sprayberry-redline]

Automated review from the Sprayberry Labs fleet code reviewer.

Reviewed by the gating lane (gating review).

Verdict: approve. Approving. The diff only rewrites the comment above repo_token in .github/workflows/scorecard.yml; the ${{ secrets.SCORECARD_TOKEN || github.token }} expression, job permissions, triggers, and SHA-pinned actions are untouched. I checked the workflow for security risks (permissions, third-party action pinning, secret handling, untrusted input) and the new comment text for generated-sounding prose, AI attribution, and secret or internal-path exposure; none found. One non-blocking note on the comment wording.

Minor:

• .github/workflows/scorecard.yml:37: The parenthetical refers to "an earlier comment" that no longer exists once this merges, so future readers have no way to know what it means, and the "5-8 of 10 here" score will silently go stale as branch rules change. Both are narration about the change rather than a constraint the code cannot show.