README: add the OpenSSF Scorecard badge that publish_results already feeds

## Problem `scorecard.yml` line 38 sets `publish_results: true`, which already pushes results into the OpenSSF public dataset via OIDC — so a live Scorecard badge would render **today** (the project is in the dataset, currently scoring **7.9**). Yet `README.md`'s badge row (Version, Go Reference, Go Version, License, CI, codecov, Go Report Card, Contributors — verified) has **no** Scorecard badge. For a project that self-attests OSPS Baseline conformance and ships a `SECURITY-POSTURE.md`, omitting its own live posture badge forgoes the main public-facing payoff of paying the `publish_results` OIDC cost. ## Fix Add to the README badge block, using the **canonical 2026 domain** (`api.scorecard.dev` / `scorecard.dev` — the action's default base URL is now `api.scorecard.dev`): ```markdown [](https://scorecard.dev/viewer/?uri=github.com/genealogix/glx) ``` - [ ] Add the badge to `README.md`. - [ ] Use `api.scorecard.dev`, not the legacy `api.securityscorecards.dev`. (The old domain is **not** deprecated — it still aliases the same dataset — but prefer the canonical domain for future-proofing.) ## Notes - No workflow change needed; `publish_results` already feeds the badge. - The badge will publicly surface the score, so landing the SHA-pin fix first (Pinned-Dependencies 4 → higher) makes the surfaced number stronger. - Trivial, good-first-issue-sized. ## Cross-refs - Analogous to #469 (add Go Reference badge). NB: the README already carries a Go Reference badge today, so #469 may be stale/closeable — worth a glance when picking this up.