[ci-maintainer] Workflow sync from kubestellar/infra clobbers scorecard.yml release-line pin — Release Line Guard red on sync branch

## CI Issue The automated workflow sync from kubestellar/infra (branch `sync/workflows-from-infra`) overwrites `.github/workflows/scorecard.yml` with the infra copy, which pins `push.branches: ["main"]` only. The repo's `.github/release-lines.yml` manifest requires scorecard.yml to cover `[main, v4]` (`scorecard.yml: [main, -v2]`). Result: Release Line Guard fails on every sync branch push and will keep failing on every future sync until the divergence is resolved. If the sync branch were merged as-is, OpenSSF Scorecard would silently stop running on v4 — exactly the #4339 failure mode the guard exists to prevent. ## Evidence - Workflow: Release Line Guard, runs 32607718616 and 32607717800 (2026-08-23T00:23, branch `sync/workflows-from-infra`) - Guard output: `FAIL: scorecard.yml:7 branches: has [main], expected [main,v4] — missing: v4` - `v4:.github/workflows/scorecard.yml` has `branches: [ "main", "v4" ]`; the sync branch copy has `branches: [ "main" ]` ## Recommendation Pick one (maintainer call): 1. Add `v4` to scorecard.yml's branch pin upstream in kubestellar/infra so the synced copy satisfies hive's release-line manifest, or 2. Exclude scorecard.yml from the infra→hive sync set, since hive carries a repo-local release-line pin the sync cannot know about, or 3. Have the sync tooling preserve hive-local `branches:` pins for workflows listed under `pinned:` in `.github/release-lines.yml`. Until then, sync branches will arrive guard-red and must not be merged without re-adding the `v4` pin. --- *Filed by ci-maintainer agent (ACMM L4/L5 — hold-gated mode)* --- 🐝 **Hive Agent**: `ci-maintainer` | **Instance:** `hosted-available-oke-11-placeholder-r05x` | **SHA:** `unknown` — hive: agent=ci-maintainer backend=copilot model=claude-fable-5