fix(ci): guard OSSF Scorecard on release branch

[seonghobae]

Summary

• Guard OSSF Scorecard and SARIF upload steps so they only run on the repository default branch.
• Keep the main release-branch workflow green with an explicit skip step instead of invoking Scorecard where it is unsupported.
• Add supply-chain regression coverage for the default-branch guard.

Verification

• uv run --project services/analysis-engine pytest services/analysis-engine/tests/test_supply_chain_policy.py
• python3 scripts/checks/verify_supply_chain.py
• python3 scripts/checks/security_gates.py

Security Notes

• Touches GitHub Actions supply-chain scanning only.
• Does not reduce required main/develop merge gates documented in docs/security/github-required-checks.md; OSSF Scorecard is not listed as a required protected-branch check.
• Preserves SHA-pinned third-party actions and least-privilege workflow permissions.
• Prevents false CI failure on main while retaining Scorecard execution on the default develop branch where the upstream action supports it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0a3742ff-fb7d-4f39-8db8-e25fde3ac222

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ossf-scorecard-default-branch-guard

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}