[Supply chain] Re-check Maintained Scorecard alert after repository age threshold

[bjcorder]

Code scanning alert covered

• #24 Maintained: Scorecard reports that the repository was created within the last 90 days.

Analysis

This is not meaningfully remediable in code today.

The repository was created on 2026-05-02, and the Scorecard Maintained check cannot fully assess repositories younger than 90 days. The 90-day mark is 2026-07-31. Until then, this is mainly a tracking item rather than a defect.

Proposed remediation

• Keep normal maintenance signals active: reviewed PRs, issue triage, dependency updates, and releases where appropriate.
• Re-run the security hygiene workflow after 2026-07-31.
• If the project is intentionally quiet after initial release, document the maintenance posture in README.md or release docs and dismiss the alert with that context.

Acceptance criteria

• The alert is rechecked after the repository passes the 90-day age threshold.
• If Scorecard still reports a low maintained score after 2026-07-31, create concrete follow-up work based on the updated warning text.
• Alert Add fixture-based rule matrix and golden reports #24 is resolved or explicitly dismissed with a time-based rationale.