feat(cli): add score subcommand wiring score.Engine

[hammadtq]

Summary

Adds the score CLI subcommand wiring pkg/score.Engine to the public CLI. Phase 1.3.

Behavior

• attach-open-score score --input <path> — read normalized evidence JSON and emit a verdict.
• --input - reads stdin.
• --policy-profile <name> (default default).
• Existing attach-open-score --root <path> fixture-validate behavior preserved as the no-subcommand default.

Smoke

$ echo '{"package":{"name":"example","version":"1.0.0","ecosystem":"npm","purl":"pkg:npm/example@1.0.0"},"evidence":[]}' | attach-open-score score --input -
{ "decision": "ASK", "score": 45, "confidence": "LOW", ... }

Verification

• go vet ./... clean
• go test ./... all packages pass (cmd, internal/fixtures, pkg/score)
• git diff --check clean
• credential-pattern scan clean
• stdlib only, no new dependencies

Source/legal

• Public Apache-2.0 only.
• Tests use synthetic example.invalid source refs.
• No proprietary vendor data.
• OSV/GHSA/deps.dev/Scorecard attribution unchanged.

Kanban: t_756e46dd

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews