feat: achieve OpenSSF Silver badge

[TFT444]

Goal

Move the OpenShield OpenSSF Best Practices badge from Passing (current) to Silver.

Badge entry: https://www.bestpractices.dev/en/projects/13618/silver
Current silver progress: ~10%

---

Context

The Passing badge (100%) was achieved on 2026-07-15. Silver is the next tier and a prerequisite for Gold. Most of the gap is documentation, not code. A realistic path to silver is 2-3 focused sprints.

---

Work breakdown

Phase 1 — Badge owner marks already-met criteria (Vishnu only)

These are satisfied by the existing codebase. The badge owner logs into bestpractices.dev, marks each Met, and pastes a URL.

Criterion	Evidence URL to paste
dco	.github/workflows/ci.yml DCO job
external_dependencies	requirements.txt in repo
dependency_monitoring	.github/dependabot.yml
updateable_reused_components	Same as above
crypto_used_network	Azure SDK enforces HTTPS
crypto_tls12	Azure SDK enforces TLS 1.2+
crypto_certificate_verification	Azure SDK verifies certs
automated_integration_testing	GitHub Actions CI workflow
warnings_strict	Ruff strict config in pyproject.toml
coding_standards_enforced	Ruff lint job in ci.yml
tests_documented_added	CONTRIBUTING.md
report_tracker	GitHub Issues
governance	GOVERNANCE.md

Estimated impact: +35-40% silver progress.

---

Phase 2 — Documentation PRs (any contributor)

• Add CODE_OF_CONDUCT.md (Contributor Covenant template)
• Add SECURITY.md with two sections: how to report a vulnerability, and what security guarantees the tool provides/does not provide
• Extend GOVERNANCE.md with a Roles and Responsibilities section (maintainer, contributor, reviewer definitions)
• Add ROADMAP.md listing planned features and explicit non-goals
• Add architecture doc to docs/ describing the scanner pipeline (scan job -> Azure SDK collectors -> rule engine -> findings API)
• Add or improve Quick Start section in README.md (install + run in 3 commands)

Estimated impact: +25% silver progress.

---

Phase 3 — Coverage reporting

• Add pytest --cov=. --cov-report=xml to the CI test job
• Connect Codecov (free for open source) so coverage is measurable
• Verify statement coverage is at or above 80%; write tests if not
• Mark test_statement_coverage80 Met on bestpractices.dev with the Codecov badge URL

Estimated impact: +10% silver progress.

---

Acceptance criteria

• Silver badge is awarded on bestpractices.dev (>=100% silver score)
• All Phase 2 docs merged to main
• Coverage >=80% shown in CI on every PR