docs: position Open Score provider semantics

[hammadtq]

Summary

• Repositions Socket as a current local BYO-token provider, not hosted/default Attach scoring.
• Adds Attach Open Score provider semantics for ALLOW/ASK/DENY/UNKNOWN mapping, provider availability, and CI/team strictness.
• Documents the score polarity mismatch so Open Score risk scores are not accidentally mapped into attach-guard's current safety-score thresholds.

Verification

• git diff --cached --check
• Added-lines secret scan
• Independent review: initial blockers fixed; re-review passed
• go test ./... not run: Go toolchain is unavailable in this runtime (go: command not found); changes are docs-only

Source/legal posture

• No vendor scores/data copied, scraped, redistributed, calibrated against, or used as fixtures.
• Socket remains local BYO-token only unless a future explicit partnership permits more.
• Attach Open Score sources remain public/open/terms-permitted with attribution/source references.

Related

• Kanban: t_29742dcc
• Builds on inspection PR: docs: inspect attach-guard CLI and tests #20

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews