governance: enroll .github in OpenSSF Best Practices

[seonghobae]

Finding

Default-branch Scorecard code-scanning alert #14 (CIIBestPracticesID) reports score 0 because this public central governance repository has no OpenSSF Best Practices badge registration.

Alert: https://github.com/ContextualWisdomLab/.github/security/code-scanning/14
Observed on main: cc3ceb2
Classification: governance / security-awareness, Low severity; not a source-code vulnerability.

Required governance action

• register the repository at https://www.bestpractices.dev/ using an authorized organization identity
• complete and justify all passing-level criteria against current repository evidence
• add the issued badge or project link to the repository governance documentation
• rerun Scorecard and verify code-scanning alert Sync OpenCode review failure handling #14 closes without dismissal
• record any criteria requiring organization-owner attestation as explicit evidence, not inferred state

Acceptance

• OpenSSF project URL is recorded in this issue
• passing badge is issued, or every unmet criterion has an owner and dated remediation
• a current-main Scorecard run no longer reports CIIBestPracticesID score 0

[seonghobae]

Current-main revalidation (2026-07-29 19:45 KST): Scorecard code-scanning alert #14 remains open on 213bef210d173fc6e4511dfdf60e3bcd0b3fad66. The finding is still CIIBestPracticesID, Low severity, with no file-associated source location; it requires authorized OpenSSF Best Practices enrollment and attestation rather than a code patch. The issue is now tracked in organization Project #1 as Todo, phase Ops, component dot-github. The alert has not been dismissed.