spec: Proposal to wire Scorecard to ExecutionContext

[justaugustus]

Summary

Draft proposal for #194 — giving the shared ExecutionContext.get_or_run_tool infrastructure from #189 its first real consumer, using OpenSSF Scorecard as the motivating heavy tool.

This PR adds only the proposal doc (specs/021-scorecard-execution-context/proposal.md) — no code yet. It records two maintainer-confirmed design decisions so we have them written down before implementation:

• Invocation backend: uwu-tools/scorecard-mcp (MCP over stdio) behind a swappable ScorecardBackend seam, so a live-scan CLI backend can be added later without touching caching or mapping logic.
• Verdict policy: evidence-only. Scorecard never changes a control's status; it only attaches evidence/hints that later passes can use. This matches both darnit's conservative-by-default constitution and scorecard-mcp's own framing (cached / opt-in / partial data; "heuristic signals, not a verdict").

The proposal also documents the existing latent infra (with file:line anchors), the backend seam + handler design, candidate Scorecard-check → OSPS-control mappings, a phased implementation plan, and open questions — notably #194's acceptance criterion 2 (cache_key consumed by adapter dispatch), flagged because the live audit path is the sieve-handler path and CheckAdapter dispatch appears vestigial.

Type of Change

• Documentation update

Framework Changes Checklist

If this PR modifies the darnit framework (packages/darnit/):

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

N/A — proposal doc only; no framework code changes.

Control/TOML Changes Checklist

If this PR modifies controls or TOML configuration:

• Control metadata defined in TOML (not Python code)

N/A — no control/TOML changes in this PR.

Testing

• Tests pass locally (uv run pytest tests/ -v)

N/A — documentation only.

Additional Notes

Requesting review from @mlieberman85.

Two things worth deciding before this graduates to a full spec.md/plan.md:

1. Acceptance criterion 2 resolution — amend the bullet (handler path is the real consumer) vs. wire the currently-unused adapter cache_key path. Proposal recommends amend.
2. The exact Scorecard-check → OSPS-control set for the first cut (minimum two from the mapping table).

Refs: #194 · Depends-on: #189