Raise the OpenSSF Scorecard score from 6.3 #148

The first OpenSSF Scorecard run on main (2026-10-18) scored 6.3 (viewer). Follow-up to #64.

Fixable:

• SAST (0): CodeQL for JavaScript and TypeScript on pushes, pull requests and weekly (ci: CodeQL, Docker image digests, jq for the Codemod token (#148) #149); first run found nothing. The score rises as commits checked by it accumulate.
• Docker images pinned by digest and the Codemod token read with jq instead of piping curl into node (ci: CodeQL, Docker image digests, jq for the Codemod token (#148) #149).
• Pinned-Dependencies (4): the workflows install tools by version, not by hash: npm install -g npm@12, pnpm@10.18.0, codemod@1.18.5 (twice), eslint@8.57.1, typescript@5.6 with @types/node@22, and wrangler@4.123.0. A lockfile per tool set with npm ci would pin them.
• Signed-Releases (-1): GitHub releases carry no signed assets. npm provenance doesn't count; attaching the tarball with its Sigstore bundle to each release would.
• CII-Best-Practices (0): register at bestpractices.dev and answer the passing-level questions (maintainer).

Accepted or waiting:

• Code-Review (0), Branch-Protection (3): one maintainer pushing straight to main. The main ruleset blocks force-pushes and deletion and requires linear history.
• Maintained (0): the repository is under 90 days old; this clears with time.
• Fuzzing (0): not planned for now.

Score badges (Scorecard, Socket) go in the README only once they reach 9 (90 for Socket). Socket's supply chain score is 81 and should rise with the package's age.

For comparison, porsager/postgres scored 3.2 on 2026-10-12.