docs(security): confirm OpenSSF Best Practices Badge tier and publish current score #551

Summary

Re-run the OpenSSF Best Practices Badge questionnaire for project 12195, confirm the current tier (passing / silver / gold), publish the score in README, and file follow-up issues for any unmet criteria.

Background

The badge was added in v0.6.0 (#3). Repository posture has materially improved since then (release-pipeline hardening in #419, Sigstore signing in #7, SECURITY.md, CodeQL, Gitleaks, Scorecard, dependency review). The badge questionnaire likely now qualifies for a higher tier.

Acceptance Criteria

• Best Practices Badge questionnaire reviewed end to end
• Current tier confirmed and badge URL updated in README
• Gap list captured for any criteria still unmet (filed as separate issues if non-trivial)
• docs/security/ includes a short note describing the tier, the date verified, and a link to the project page
• CONTRIBUTING.md references the badge requirements for new contributors

Related

• Builds on docs(docs): Add OpenSSF Best Practices badge to README #3 (OpenSSF Best Practices Badge added)
• Related to Add hve-core release pipeline with dependency SBOM, signing artifacts, and Scorecard fixes #419 (release pipeline hardening that supports higher-tier criteria)