ci: add advanced CodeQL workflow (replaces default setup) (#128)

## Summary
- GitHub default setup for code scanning (analyzing `actions`,
`javascript-typescript`, `rust` with the `default` query suite,
`remote_and_local` threat model, weekly schedule) was disabled today
(2026-07-20).
- The main branch ruleset has a `code_scanning` rule requiring CodeQL
results (alerts_threshold: errors, security_alerts_threshold:
high_or_higher), so a committed advanced workflow is needed to keep that
gate satisfied on PRs.
- Adds `.github/workflows/codeql.yml`: a matrix job over `actions`,
`javascript-typescript`, `rust` (all `build-mode: none`), triggered on
push to main, pull requests into main, and a weekly Monday 09:30 UTC
schedule.
- `threat-models: [remote, local]` is set via the `init` step's `config`
input to match the prior default-setup threat model.
- Analysis `category` stays in the `/language:<lang>` form so the 11
previously-dismissed Rust test-code false positives continue to match
and their dismissals carry over.

## Test plan
- [x] `actionlint .github/workflows/codeql.yml` passes clean
- [x] File uses LF line endings (verified via `git ls-files --eol`), no
em-dashes
- [ ] Confirm the `code_scanning` ruleset check is satisfied once this
workflow runs on the PR
- [ ] Confirm the 11 previously-dismissed Rust alerts remain dismissed
after the first advanced-workflow analysis

Generated with Claude Code

https://claude.ai/code/session_01QZQVP2tUuTLh8oL31D8heC

Author: pmaxhogan

.github/workflows/codeql.yml

@@ -0,0 +1,51 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, Monday 09:30 UTC - a quiet time with no other scheduled workflow.
+    - cron: "30 9 * * 1"
+
+permissions:
+  security-events: write
+  packages: read
+  actions: read
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+          - language: rust
+            build-mode: none
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          # Match the prior default-setup threat model (remote_and_local).
+          config: |
+            threat-models:
+              - remote
+              - local
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"