docs(profile): add OpenSSF Scorecard badge to trust-signal row

[amavashev]

Adds the live OpenSSF Scorecard badge (auto-updates from api.scorecard.dev) alongside the existing License / Release / CI / Coverage row.

Score basis

cycles-server: 7.4/10 as of 2026-05-02 — already above the publishable threshold (≥7).

Why this is meaningful

The Scorecard is the only independent third-party security signal in the badge row. Everything else (license, release version, CI green, coverage %) is self-reported. Scorecard is computed by OpenSSF based on observable repo state — branch protection, signed commits, dependency review, pinned dependencies, token permissions, vulnerability disclosure, SAST coverage, etc.

Background

This badge caps a session of supply-chain hardening work:

• All 13 high-value runcycles repos now run the Scorecard workflow (cycles-server + 5 SDKs + 5 services + cycles-protocol + .github)
• cycles-server hardened from 6.1 → 7.4 via three PRs:
  • #143 — pin all third-party action SHAs
  • #144 — tighten workflow token permissions to read-all + per-job scopes
  • #145 — patch Alpine gnutls (CVE-2026-33845 + 12 bundled gnutls CVEs)
• The other 12 repos got the same SHA-pin + permissions sweep; their next scheduled scan should land in similar territory

Future improvements that could push above 8

• CII Best Practices badge (separate questionnaire submission at bestpractices.coreinfrastructure.org). Realistic Passing today; Silver after small additions.
• Branch-Protection check currently scores -1 ("internal error"). Setting up a Scorecard PAT with admin:repo scope would unblock the check and likely add ~0.5 to the overall score.
• Code-Review check scores 0/10 because solo merges don't have approval signatures. Fixable only with another reviewer in the rotation.

Test plan

• On the PR Files-changed → View file, confirm the new badge renders (5 badges in the row should wrap cleanly on desktop and mobile)
• Click the Scorecard badge → confirm it links to https://scorecard.dev/viewer/?uri=github.com/runcycles/cycles-server
• After merge, sanity-check at https://github.com/runcycles