chore: unshadow front-page README, improve Scorecard posture

[jeffreylouden]

Description

Follow-up to #633: the rewritten README wasn't actually the repo front page, because GitHub prefers .github/README.md over the root README.md — and .github/README.md here is the internal "CI configuration notes" doc for the assign-ids GitHub App. This PR fixes that and picks up the in-repo-fixable OpenSSF Scorecard findings:

• Rename .github/README.md → .github/CI_NOTES.md (content unchanged) so the root README becomes the front page. The one reference to the old path (comment in assign-ids.yml) is updated.
• SECURITY.md: adds actual reporting channels — GitHub private vulnerability reporting link and a maintainer email — plus a disclosure-window note and a release-integrity section. Addresses Scorecard's Security-Policy warning "no linked content found" (currently 4/10).
• Release provenance: release.yml now generates Sigstore build provenance for catalog.sqlite and catalog-index.json via actions/attest-build-provenance (SHA-pinned, matching the repo's pinning convention) and attaches the bundle to the release as catalog.intoto.jsonl. Addresses the Signed-Releases warning "release artifact does not have provenance" (currently 8/10). The attest step is continue-on-error and the staging step is gated on its outcome, so a Sigstore outage can never break a release — same philosophy as the existing bookkeeping steps. Job gains id-token: write + attestations: write.
• README's release-assets line mentions the new provenance asset.

Type of Change

• New software/plugin entry
• New hardware entry
• New manufacturer entry
• Update to existing entry
• Bug fix
• Schema or script change

Checklist

• I have run pnpm validate and it passes (no data files touched)
• YAML files follow the existing format (workflow YAML parse-checked)
• Manufacturer exists (or I'm adding it in this PR) — n/a
• Categories and formats are from the schema files — n/a
• Identifiers are accurate, if provided — n/a

Additional Notes

Two Scorecard items need repo settings rather than code, so they are not in this diff: GitHub private vulnerability reporting should be enabled (Settings → Advanced Security) for the new SECURITY.md link to work, and Branch-Protection warns that admin enforcement is off on main. Code-Review (0/10) and Contributors (3/10) reflect the solo-maintainer/auto-merge workflow and aren't realistically fixable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GmHrQEQmpYthrHhmV2cB2c

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2101e93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 50 minutes

Limit details: You’ve used the included review currently available. Your 106 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

You’re in a promotional period — use the checkbox below to run this review for free:

• Run review for free

_{On-demand reviews are free for the next 31 days. After that, they cost $0.25 per reviewed file.}

How can I continue?

Run this review now using the option above, or comment @coderabbitai review --use-credits.

You can also wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fed5a683-f220-4c7f-8306-b234acfcd136

📥 Commits

Reviewing files that changed from the base of the PR and between 1d35bbc and 2101e93.

📒 Files selected for processing (5)

• .github/CI_NOTES.md
• .github/workflows/assign-ids.yml
• .github/workflows/release.yml
• README.md
• SECURITY.md

---

_{Comment @coderabbitai help to get the list of available commands.}