Supply-chain health from deps.dev: OpenSSF Scorecard (14 checks — branch protection, signed releases, pinned deps…) plus stars, license and open issues