chore(brand): em-dash sweep + scorecard publish_results fix

[amcheste-ai-agent]

Summary

Brand-alignment pass against the alanchester-brand voice rules, plus a workflow fix for the OpenSSF Scorecard badge.

1. Em-dash sweep (12 files, 177 dashes)

Mechanical replacement of — with . and capitalization of the following letter when it was lowercase. Code blocks and markdown table rows protected. Same approach as claude-teams-operator#224.

File	Em-dashes swept
README.md	14
CONTRIBUTING.md	10
CLAUDE.md	2
CHANGELOG.md	1
docs/design/claude-bot-account.md	25
docs/tooling/dev-tooling-stack.md	11
docs/workflows/ci-automation.md	31
docs/workflows/branching-and-releases.md	16
docs/philosophies/branching-strategy.md	14
docs/philosophies/release-cadence.md	11
docs/philosophies/testing.md	20
docs/philosophies/security-posture.md	22

Post-sweep grep -nE '\. [a-z]' audit produced 5 matches, all abbreviation false positives (e.g., i.e., E.g.) left as-is.

2. Scorecard publish_results fix

The OpenSSF Scorecard badge on the README was returning 404 from the public API. Root cause: this repo's default branch is develop (intentional, until a stable first release switches default to main), but the workflow only published Scorecard results when github.ref == 'refs/heads/main'. Scheduled runs were succeeding on develop but never publishing.

Verified by direct API query before the fix: curl api.securityscorecards.dev/projects/github.com/amcheste/engineering-handbook returned HTTP 404.

The fix

.github/workflows/scorecard.yml (3 lines):

   push:
-    branches: [main]
+    branches: [main, develop]

           results_format: sarif
-          publish_results: ${{ github.ref == 'refs/heads/main' }}
+          publish_results: ${{ github.ref_name == github.event.repository.default_branch }}

       - uses: github/codeql-action/upload-sarif@d4b3ca9fa7f69d38bfcd667bdc45bc373d16277e # v4
-        if: github.ref == 'refs/heads/main'
+        if: github.ref_name == github.event.repository.default_branch

Why this works across your develop-then-main lifecycle

Phase	Default	Schedule on	publish_results	Result
Pre-first-release (now)	develop	develop	develop == develop ✓	publishes from develop
First stable release; default switches to main	main	main	main == main ✓	publishes from main; auto-transitions
Steady state (main = releases, develop = integration)	main	main	main publishes, develop pushes don't	clean: public score == release state

github.event.repository.default_branch resolves dynamically per run, so no workflow edit needed when you flip the default branch in GitHub Settings. Brief lag (up to one Monday cycle) on the badge after a default-branch switch; self-heals.

What this PR does NOT include

• Repo topics — currently null. Adding engineering, handbook, philosophies, workflows, ai-amplified, software-practices via gh repo edit is a manual public-state change, flagged for separate action.
• Banner — README has no banner image. A Claude Design prompt has been drafted for separate use. Banner will land in a follow-up PR after the design session.
• The same scorecard publish_results bug in repo-template — propagating the fix there is queued as a follow-up so future repos born from the template don't inherit the bug.
• claude-teams-operator's scorecard failure — different cause (imposter-commit pin on github/codeql-action/upload-sarif), queued as a follow-up there.

Verification

• git diff develop --name-only → 13 files. No edits outside docs/, root prose, or .github/workflows/scorecard.yml.
• Em-dash sweep: 177 removed, 5 abbreviation false positives remaining (documented).
• Scorecard fix: 3 lines in one file. No other workflow changes.

🤖 Generated with Claude Code