fix(scorecard): drop archived polystack target, add boj-server-cartridges

[hyperpolymath]

Summary

polystack was archived during the 2026-05-26 cartridge-extraction initiative — its 11 LSP halves migrated into the new hyperpolymath/boj-server-cartridges repo (boj-server-cartridges PRs #1-#8, all merged). The scorecard target manifest still pointed at the archived repo, causing every scan run to skip the target silently.

This replaces the stale polystack entry with the migration target boj-server-cartridges (placed alphabetically adjacent to the existing boj-server entry).

Diff

   {"local": "boj-server", "github": "hyperpolymath/boj-server"},
+  {"local": "boj-server-cartridges", "github": "hyperpolymath/boj-server-cartridges"},
 ...
-  {"local": "polystack", "github": "hyperpolymath/polystack"},

Per boj-server-cartridges/docs/handover/2026-05-26/prompts/earlier-03-hypatia-scorecard-polystack-ref.adoc.

Test plan

• jq . validates the JSON.
• git grep polystack -- '*.json' shows zero remaining hits.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 2 issues detected

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	1

View findings

[
  {
    "reason": "Repository has 13 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence