Earn OpenSSF Best Practices badge and OSPS Baseline L1/L2/L3 (partial)

[timlnx]

Summary

This branch picks up the OpenSSF Best Practices passing badge and works through OSPS Baseline Levels 1, 2, and 3. The substantive deliverables are policy, verification, and architecture documents that survive both human review and the OpenSSF automated scanner.

Final score against each badge:

• OpenSSF Best Practices (passing): badge embedded in README and docsite.
• OSPS Baseline Level 1: 23 Met / 2 N/A / 0 Unmet.
• OSPS Baseline Level 2: 19 Met / 0 Unmet (after this branch).
• OSPS Baseline Level 3: 18 Met / 2 N/A / 1 structurally blocked (OSPS-QA-07.01 requires a non-author reviewer; cannot satisfy as a single-maintainer project without changing governance).

Documents added at repository root

• MAINTAINERS.md — sole maintainer, sensitive resource access, responsibilities, and a standing open call for a Debian/Ubuntu co-maintainer (references issue Deb Maintainer Wanted #117).
• ARCHITECTURE.md — design documentation covering runtime architecture, build/release pipeline, CI gates, trust boundaries, and documentation pipeline. Lives at root so the OpenSSF scanner picks it up via filename match.
• SECURITY_ASSESSMENT.md — standing threat model describing attack surfaces, mitigations, and the automated security tooling stack.
• SECURITY_POLICIES.md — combined SAST/SCA remediation thresholds and release-blocking criteria.
• VERIFICATION.md — downstream consumer guide for verifying release integrity (SHA-256), authenticity (PEP 740 attestations via pypi-attestations), and provenance (CycloneDX SBOM).

Documents updated

• SECURITY.md — added explicit CVD response timeframes (72h acknowledge, 7d triage), Scope of Support and Duration of Support sections, and Secrets and Credentials Policy.
• docsite/source/contributing.rst — added Project Architecture section pointing at ARCHITECTURE.md; converted Automated Tests into a Testing Policy with MUST language for major changes.
• README.rst and docsite/source/index.rst.in — three OSSF/security badges (Scorecard, Best Practices, Baseline) grouped on a new top row above the existing CI/PyPI badge cluster.

Tooling added

• .github/workflows/sca.yml — pip-audit (PyPA-official) on every push and pull request, plus weekly schedule.
• .github/workflows/publish.yml — CycloneDX SBOM generation step that installs the built wheel into an isolated venv, snapshots it with cyclonedx-py, and attaches the resulting bitmath-<version>.cdx.json to the GitHub release.

⚠️ One manual follow-up after merge

To make sca.yml enforce the SCA policy as a merge gate (required for OSPS-VM-05.03), add the audit job to the required status checks on master:

Settings → Branches → master → Edit protection rule → Status checks → Add: audit

The first PR after merge will create the check run that you can then add to the required list.

Test plan

• make ci passes on local working tree
• make docs rebuilds cleanly with zero Sphinx warnings
• CycloneDX SBOM generation smoke-tested locally against built wheel (produced expected components: bitmath + pip + setuptools)
• Both new workflow YAMLs parse cleanly
• All cross-references and anchor links verified intact after the testing-policy anchor rename
• Zero em-dashes in any new prose
• All section headers in new docs comply with project title-case convention
• CI passes on the PR
• After merge, add audit to required status checks