chore: oss-hygiene — dependabot + dep-review + scorecard, harden workflow permissions

[paulnsorensen]

Summary

Closes the free supply-chain and workflow-hardening gaps surfaced by an /oss-hygiene audit. No paid GitHub features required — everything here is free for public repos.

Added

• .github/dependabot.yml — weekly version updates for the three ecosystems present in this repo:
  • cargo (root Cargo.toml)
  • npm (npm/package.json — the install wrapper)
  • github-actions (keeps action versions current, with minor/patch grouping)
  • Python under benchmark/ is skipped — it's the evaluation harness, no top-level manifest.
• .github/workflows/dependency-review.yml — fails PRs that introduce moderate-or-worse vulnerable deps or disallowed licenses. Free on public repos.
• .github/workflows/scorecard.yml — publishes OpenSSF Scorecard SARIF + badge data. Runs on push to main and weekly.

CodeQL is not added: Rust isn't supported by actions/codeql-action, and the npm/ surface is just a binary-download proxy — signal would be near-zero.

Hardened

Per OSSF Scorecard's Token-Permissions check:

• ci.yml — adds top-level permissions: { contents: read }. The workflow only reads; no reason to inherit write defaults.
• release.yml — top-level contents: write is too broad. Tightened to contents: read and the write scope moved to only the build job, which actually needs it for softprops/action-gh-release. version-check, publish-crate, and publish-npm inherit read-only — the publish jobs use CARGO_REGISTRY_TOKEN / NPM_TOKEN secrets, not GITHUB_TOKEN, so this is safe.

Dangerous-Workflow audit: clean. Neither workflow uses pull_request_target.

Follow-ups (filed as separate issues)

• Enable free GitHub-native security features (Dependabot alerts, secret scanning, push protection).
• Scaffold community standards files (CoC, CONTRIBUTING, SECURITY, issue/PR templates).
• Register for the OpenSSF Best Practices Badge and add the Scorecard badge to the README.

Test plan

• CI green on this PR (existing cargo fmt / clippy / test job, now with contents: read).
• dependency-review job runs on this PR and passes (no new deps were introduced).
• After merge, scorecard.yml runs on main and uploads SARIF without error.
• Dependabot opens grouped PRs for outdated cargo / npm / actions deps within ~24h.
• Next tagged release still succeeds end-to-end (build matrix + releases + crates.io + npm).

---

🧀 Generated via the /oss-hygiene skill from skillz-that-grillz.

[jahala]

Thank you so much, again, @paulnsorensen for contributing this! As I've mentioned, I'm not really a developer - so these things you are helping improve now, are things I'm completely blank about. Thank you! 🙏🏻 Much appreciated