ci(security): add CodeQL code scanning for JS/TS

[0xcucumbersalad]

Adds CodeQL static analysis to CI. The repo has a sast.yml today, but it only
runs gitleaks (secret scanning) — there is no static analysis of the code
itself. This adds it.

Scoped to javascript-typescript on purpose: one extractor covers
.js/.jsx/.ts/.tsx and needs no build, so a single build-free pass covers the
whole apps/ + packages/ TypeScript surface (~3.3k files).

What's here

• .github/workflows/codeql.yml — one analyze job: checkout → init → analyze.
• .github/codeql/codeql-config.yml — query suite and path exclusions.

Triggers follow test.yml: PRs to main, pushes to main, plus a weekly cron.
The cron matters more than it looks — CodeQL ships new queries continuously, and
a scheduled run against the default branch is what applies them to code that
already merged.

Concurrency cancels superseded PR runs only; pushes to main each keep their own
alert set. Permissions are contents: read at the workflow level, with
security-events: write and packages: read scoped to the job. Actions are
pinned to full commit SHAs with version comments, matching the convention
sast.yml documents.

Notes for review

• Query suite. Using the default (low-false-positive) suite for the first
  rollout so the initial alert list stays actionable. security-extended is in
  the config, commented, ready to switch on once the baseline is triaged.
• The 120-minute timeout is headroom, not an estimate. Worth checking the
  first run's real duration and tightening it.
• No path filters. This runs on every PR, including docs-only ones. test.yml
  gates jobs through a changes job to avoid that; I kept this always-on since
  it's a security scan, but it's an easy change if the CI minutes bother you.
• Expect a batch of alerts on the first run against main. Triage is separate
  from this PR — nothing here blocks a merge on findings.

---

Summary by cubic

Adds CodeQL code scanning for JS/TS to CI to surface security issues early. CI previously only ran gitleaks; this adds a build-free javascript-typescript analysis on PRs, pushes to main, and a weekly scan.

• Single analyze job with minimal permissions, pinned actions, and a 120‑minute timeout; CI-only change.
• Uses the default low-noise query suite; security-extended is prepped but commented out.
• Excludes vendored and build artifacts; node_modules is auto-excluded by the extractor.
• Triggers on all PRs and pushes to main plus a weekly cron; PR runs cancel on updates, pushes keep separate alert sets.
• Scoped to JS/TS only; Go/Python/Rust are documented as out of scope for now. Expect initial alerts on main; no developer action required to adopt.

^{Written for commit d09c73d. Summary will update on new commits.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.