chore: add .bestpractices.json + lint workflow

[aksOps]

Summary

The OpenSSF Best Practices BadgeApp at bestpractices.dev reads a repo's `.bestpractices.json` on demand to populate proposed answers when the maintainer clicks "Save (and continue) 🤖" on the project's edit page (per docs/bestpractices-json.md upstream).

This PR lands the project's source-of-truth answers for the 67 passing-tier criteria, plus a lint workflow.

`.bestpractices.json` — flat `_status` / `_justification` pairs.

• 58 Met — license, docs, tests, CI, static analysis, crypto, delivery, vulnerabilities-clean, etc.
• 3 Unmet — `contribution`, `contribution_requirements`, `vulnerability_report_process` (CONTRIBUTING.md + SECURITY.md not yet authored — kept honest rather than aspirational, with each justification noting the follow-up).
• 6 N/A — `crypto_pfs` (TLS is the operator's reverse proxy), the four `dynamic_analysis_*` (Go is memory-safe; integration tests cover the realistic surface), `release_notes_vulns` (no published vulns yet).
• 0 ?.

`.github/workflows/bestpractices.yml` — lints the file on every push or PR that touches it. Validates:

1. JSON parses
2. `_status` values ∈ {Met, Unmet, N/A, ?}
3. Every `_status` has a matching `_justification` string
4. All 67 passing-tier criteria from the upstream criteria.yml are present
5. No unknown / typo'd criterion keys

The lint runs in plain Python 3 (no extra deps).

Follow-up to register the project

1. Sign in at https://www.bestpractices.dev/en/projects/new with GitHub
2. Submit; BadgeApp assigns a numeric PROJECT_ID
3. Open the project's edit page → click "Save (and continue) 🤖" — the BadgeApp pulls `.bestpractices.json` from the repo and pre-fills every answer
4. Update the README badge per the comment block in README.md (substitute PROJECT_ID)

Test plan

• CI green
• Lint workflow runs and passes on this PR
• After merge, register the project at bestpractices.dev and confirm answers ingest cleanly

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud