chore(brand): em-dash sweep + scorecard publish_results fix

[amcheste-ai-agent]

Summary

Brand-alignment pass against the alanchester-brand voice rules. 105 em-dashes addressed across 7 prose files, plus the now-standard Scorecard publish_results fix.

1. Em-dash sweep (7 files, 105 dashes addressed)

File	Em-dashes
README.md	33
CONTRIBUTING.md	11
CLAUDE.md	20
TESTING.md	27
VERSIONING.md	8
CHANGELOG.md	4
SECURITY.md	2

87 swept mechanically via re.sub(r' — ([a-z])', lambda: '. ' + capitalize, ...) with code-block and table-row protection. Same approach as engineering-handbook PR #16 and claude-teams-operator PR #228.

18 swept manually with contextual judgment:

• Mid-table appositives (X — Y where Y describes X) → commas. E.g. pyenv — switch versions → pyenv, switch versions.
• Longer table-cell continuations → period + capitalize. E.g. Persist facts across sessions — supplements CLAUDE.md → Persist facts across sessions. Supplements CLAUDE.md.
• List-introducing em-dashes → colons. E.g. Breaking changes — tools removed, ... → Breaking changes: tools removed, ...
• Stable-state appositives → semicolons. E.g. Pre-stable — actively being developed → Pre-stable; actively being developed.
• Two end-of-line em-dashes in CLAUDE.md (...productive —\ntools, dotfiles...) → commas with continuation.

One em-dash deliberately preserved: TESTING.md:73 (# Dry run — show what would execute without running) is inside a ```bash code block (a shell comment example for act --dryrun). Per theming-prompt rules on code structure, this stays.

Post-sweep audit clean: 1 match on grep -nE '\. [a-z]' — README.md:149 "Region (e.g. iad): iad" — abbreviation false positive (e.g.), left as-is.

2. Scorecard publish_results fix

Same one-pattern fix as engineering-handbook, repo-template, and claude-teams-operator:

   push:
-    branches: [main]
+    branches: [main, develop]

           results_format: sarif
-          # Only publish to scorecard.dev from main — the action enforces this
-          publish_results: ${{ github.ref == 'refs/heads/main' }}
+          # Publish to scorecard.dev only from the default branch.
+          publish_results: ${{ github.ref_name == github.event.repository.default_branch }}

       - uses: github/codeql-action/upload-sarif@... # v4
-        if: github.ref == 'refs/heads/main'
+        if: github.ref_name == github.event.repository.default_branch

This repo's default is currently main, so no behavior change today. But the workflow is now correct regardless of which branch is set as default — consistent with the family pattern and forward-compatible if you ever flip to develop as default for a pre-stable-release phase.

Note on the codeql-action SHA

The github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 pin on develop is real and correct — verified via the GitHub API. No imposter-commit issue on develop.

main still has the older imposter SHA (d4b3ca9f... from when it was last updated from repo-template). That'll resolve on its own at the next release promotion (develop → main), since develop already has the real SHA.

What's NOT in this PR

• Banner migration (assets/logo.png → assets/banner.svg per banner-spec). Same follow-up as pokemon-red-ai, overleaf-mcp, etc.
• Repo topics (repositoryTopics: null). Manual gh repo edit.

Verification

• git diff origin/develop --name-only → 8 files. No edits to setup.sh, Brewfile*, Formula/, claude-skills/, dotfiles/, or scripts/.
• grep -rn "—" *.md → 1 result (TESTING.md:73, shell-comment example in code block).
• Em-dashes in newly-rewritten prose: 0.
• Em-dashes in code blocks / shell comments: preserved.

🤖 Generated with Claude Code

[amcheste]

Merge activity

• May 12, 12:27 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 12, 12:27 AM UTC: @amcheste merged this pull request with Graphite.