ci: scorecard comment says what the job token reads

[askalf]

From the 2026-09-25 audit of every action, item 24: the comment above repo_token says the Branch-Protection check "errors out (-1)" without a SCORECARD_TOKEN secret. It does not: no repo in the estate sets the secret, every run takes the github.token fallback, and Branch-Protection scores 5-8 from the public rules. The comment now says what the token can and cannot read. The expression is unchanged, so a PAT set later still takes precedence.

[sprayberry-redline]

Automated review from the Sprayberry Labs fleet code reviewer.

Reviewed by the gating lane (gating review).

Verdict: approve. Comment-only change to the scorecard workflow; the repo_token expression, triggers, permissions and pinned action SHAs are untouched, so there is no behavioural or security change. The new comment text is plain prose with no AI attribution, secrets or generated-sounding filler. One non-blocking note on the wording.

Minor:

• .github/workflows/scorecard.yml:37: The parenthetical "not the -1 an earlier comment claimed" refers to the comment's own edit history rather than the workflow. Once this merges nobody reading the file can see the earlier comment, so the clause is noise for the next reader; the PR description already records the correction.