scorecard: consolidate to single scRun() call

[justaugustus]

Summary

Consolidate the Scorecard policy's check execution from N+1 scRun() calls to a single batch call, eliminating redundant check execution when SARIF upload is enabled.

Motivation

When upload.sarif: true is configured, every Scorecard check runs N+1 times — N times individually in the per-check loop (for issue text), then once more as a batch in uploadSARIF() (for SARIF + results collection). This doubles the CPU, I/O, and API cost of every scan.

Investigation of Scorecard's Run() function confirms batch execution is safe: all checks run concurrently in separate goroutines, per-check errors are captured in CheckResult.Error (not as a top-level error), and Result.Checks always contains all results.

Changes

• Check() now calls scRun() once with all valid checks, then iterates Result.Checks for issue text generation
• uploadSARIF() renamed to uploadSARIFResult() — accepts an existing *sc.Result instead of re-running checks
• Unknown check names filtered before Run() and skipped (previously broke the loop, losing subsequent checks)
• Per-check errors skipped with a warning (previously broke the loop, losing subsequent checks)
• Archived the completed evidence-upload OpenSpec proposal to openspec/changes/archive/

Net result: -41 lines of code, simpler control flow, better error resilience.

Behavioral changes

Behavior	Before	After
Check execution count	N+1	1
Unknown check name	Breaks loop, loses subsequent	Filtered, remaining execute
Per-check error	Breaks loop, loses subsequent	Skipped, remaining produce results

Test plan

• All 18 existing tests pass
• go vet clean
• go build clean

🤖 Generated with Claude Code