…ergence set (#205)

## Summary

5th and final reusable in the workflow convergence campaign (see #199
for the meta-doc). Consolidates the per-repo `scorecard.yml` workflow.

## Drift signal (full pagination + per-repo verified)

- **258** top-level estate deployments
- **626** nested copies in monorepos (asdf-tool-plugins,
developer-ecosystem, ssg-collection, standards, ambientops,
julia-ecosystem, etc. — Layer-2 truncation discovery via #204's helper)
- **46** unique blob SHAs / 17.8% structural drift
- Top SHA covers **100/258 (38.8%)** — highest dominant-cluster of the 5
campaigns
- Top 7 SHAs cover ~80%
- **100% mechanical drift, ZERO feature variance** — SPDX header
(PMPL-1.0 / PMPL-1.0-or-later / MPL-2.0), `upload-sarif` SHA-pin churn,
`permissions: read-all` vs `contents: read` wording

## Design

- One input: `runs-on` (default ubuntu-latest)
- No `secrets: inherit` — Scorecard uses `GITHUB_TOKEN` directly
- Caller MUST grant `security-events: write` + `id-token: write` on the
calling job (called-workflow permissions are capped by caller)
- Caller keeps own `on:` triggers + `concurrency:` group

## Per Layer-3 caveat from the campaign meta-doc

Nested workflows are inert — GitHub Actions only runs
`.github/workflows/` at the repo root. Sweeping the 626 nested copies is
single-source-of-truth cleanup, not security hardening.

## Campaign convergence set (closes with this PR)

| PR | Template |
|---|---|
| #187 | mirror-reusable.yml |
| #190 | secret-scanner-reusable.yml |
| #192 | codeql-reusable.yml |
| #193 | hypatia-scan-reusable.yml |
| #194 | sweep-classifier scripts |
| #199 | campaign meta-doc |
| #204 | list-workflow-paths.sh (bypass /search/code undercount) |
| **this** | **scorecard-reusable.yml** |

## Test plan

- [ ] Wrapper sweep (~258 top-level + ~626 nested) — owner-gated; not
part of this PR
- [ ] Update classify-* scripts to consume helper TSV — follow-up

🤖 Generated with [Claude Code](https://claude.com/claude-code)

…consumers (#204)

## Summary

Two-commit change adding nested-path support to the sweep-classifier
pipeline:

1. **`scripts/sweep-classifiers/list-workflow-paths.sh`** — walks `gh
repo list` and queries each repo's Git Tree API directly. Bypasses two
compounding undercounts in `gh api /search/code`.
2. **All 4 `classify-*.sh` scripts updated** to consume the helper's TSV
output and emit the sweep-target path as an explicit column.

## Why the helper exists — 3 layers of undercount

1. **Layer 1 — path-prefix filter:** `path:.github/workflows` matches
the path PREFIX, excluding nested
`<subdir>/.github/workflows/<file>.yml` paths outright.
2. **Layer 2 — org-scope truncation:** even broad `filename:<file>.yml
org:<org>` queries hit internal caps. Validated against `scorecard.yml`:
broad query saw 152 paths (all flagged top-level); per-repo enumeration
found **626 additional nested copies** the broad query missed entirely.
3. **Layer 3 — nested workflows are inert:** GitHub Actions only runs
`.github/workflows/` at the repo root. Nested copies are vendored
templates / stale leftover. Security campaigns gain nothing from
sweeping nested copies; single-source-of-truth campaigns still benefit.

## Helper output

TSV, one row per matching workflow file:

```
<repo>\t<path>\t<blob-sha>\t<top-level|nested>
```

Cost: one Git Tree API call per repo (~300 calls), uses `core` bucket
(5000/hr) not throttled `code_search` (10/min).

## Classifier extensions

Each `classify-*.sh` now auto-detects input format from the first byte:
- `{` → JSONL from `gh /search/code` (legacy path)
- otherwise → TSV from `list-workflow-paths.sh` (preferred — handles
nested)

Output is unified to 7 columns: `repo \t path \t sha \t class \t reason
\t lines \t details`. The new `path` column carries the file's location
inside the repo, so sweeps can target nested copies as first-class
wrapper sites.

Shared `normalize_input` extracted into `_lib.sh`; each classifier
sources it.

## Validation

Smoke-tested both input paths:
- TSV (helper): classify-mirror.sh on scorecard-tuples.tsv (287 repos ×
top-level + nested) — fetches blobs and emits per-(repo, path) rows.
- JSONL (legacy): classify-mirror.sh on mirror-full.json — 267 TRIVIAL +
22 NEEDS_REVIEW, matching prior `/tmp/drift-survey/sweep-report.md`.

## Stacked on #194

`scripts/sweep-classifiers/` only exists once #194 merges. The diff
against `main` includes #194's files transitively; once #194 lands, this
PR narrows to just the helper + extensions.

## Standing follow-ups

- Once this lands, re-survey each candidate with the helper for
ground-truth wrapper-site counts before firing any sweep.

🤖 Generated with [Claude Code](https://claude.com/claude-code)