chore(security): bump upload-artifact v4.6.2 -> v7.0.1 + add OpenSSF Scorecard

[bilbospocketses]

Two security-followup items from a cross-repo posture audit vs. ws-scrcpy-web and oao.

upload-artifact bump (ci.yml 1 site, release.yml 3 sites)

• SHA ea165f8d (v4.6.2) -> 043fb46d (v7.0.1).
• Closes the Node 20 deprecation banner that has been firing on every workflow run since GitHub's force_node24 cutover was announced for 2026-06-02; v7.x runs on Node 24.
• Root cause of why this drifted while every other action stayed current: the prior pin had a bare # v4 comment (just the major). Dependabot's github-actions ecosystem uses the trailing comment as the version anchor — bare-major is interpreted as a "track v4 line" range pin, so it never proposed a major-bump PR even though v5, v6, and v7 had all shipped upstream.
• The 5 other actions in this repo all had precise # v<x>.<y>.<z> comments at SHA-pin time and got Dependabot bumps in PRs build(deps): bump actions/setup-dotnet from 4.3.1 to 5.2.0 #1, build(deps): bump actions/attest-build-provenance from 2.4.0 to 4.1.0 #2, build(deps): bump actions/checkout from 4.3.1 to 6.0.2 #3, build(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 #4, build(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.0 #5 on 2026-05-18. upload-artifact was silently skipped — Dependabot Updates workflow run log for that day shows 5 individual for actions/<x> - Update runs and zero for upload-artifact.
• New pin uses precise # v7.0.1 comment so future bumps surface normally.
• v5 breaking change check: v5 dropped immutable artifact names (same name: rejected twice per run). This repo uses 4 distinct names across the 4 upload sites (test-results, unsigned-windows-exes, unsigned-windows-msi, windows-final), so safe.

OpenSSF Scorecard workflow (new .github/workflows/scorecard.yml)

• Triggers: branch_protection_rule (catches master-ruleset regressions), weekly cron Monday 09:00 ET (matches Dependabot + CodeQL cadence), push to master.
• SARIF uploads to Security tab (security-events: write) so findings sit next to CodeQL. Published to api.securityscorecards.dev via OIDC (id-token: write) for the public scorecard.dev/viewer/?uri=github.com/bilbospocketses/control-menu page.
• All actions SHA-pinned with precise version comments. Workflow-level permissions: read-all with narrower per-job grants.
• Allowlist: ossf/scorecard-action@* added to repo-level patterns_allowed (was just softprops/action-gh-release@*). github/codeql-action/upload-sarif is github-owned, covered by github_owned_allowed. Pre-merge — already applied via gh api PUT.
• Mostly informational — CM already passes the bulk of Scorecard's checks via the Tier 1-5 hardening pass. Ongoing value is drift detection.

Test plan

• CI build-and-test passes (uses bumped upload-artifact step for test-results)
• Post-merge: scorecard.yml runs on the merge commit's push-to-master and uploads SARIF
• Post-merge: next tag push exercises release.yml's 3 upload-artifact sites on v7.0.1