docs(readme): add OpenSSF Best Practices passing badge (DPLAN-0193)

CHANGELOG.md

@@ -33,6 +33,11 @@ and this project uses [Calendar Versioning](https://calver.org/) in the format
   flowed into handlers but was never logged, leaving no way to tell an internal
   main-turn fire from a real sub-agent fire. Pure visibility; no behavior change.
   Groundwork for #606. (#606)
+- **OpenSSF Best Practices passing badge** — AIPass earned the OpenSSF Best
+  Practices (CII) **passing** badge (100% of criteria), added to the README badge
+  cluster. Self-certified across all six categories — basics, change control,
+  reporting, quality, security, and analysis. Complements the existing OpenSSF
+  Scorecard, lifting the `CII-Best-Practices` check from 0. (DPLAN-0193)
 
 ### Changed
 

README.md

@@ -5,6 +5,7 @@
 [![Give Feedback](https://img.shields.io/badge/Give-Feedback-brightgreen)](https://github.com/AIOSAI/AIPass/issues/new?template=feedback.yml)
 [![codecov](https://codecov.io/gh/AIOSAI/AIPass/graph/badge.svg)](https://codecov.io/gh/AIOSAI/AIPass)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AIOSAI/AIPass/badge)](https://scorecard.dev/viewer/?uri=github.com/AIOSAI/AIPass)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13095/badge)](https://www.bestpractices.dev/projects/13095)
 
 <p align="center">
   <img src="assets/logo.png" alt="AIPass" width="400" />