ci: push code graph to StageWD and ProdWD

[rbg]

What this does

Adds .github/workflows/codegraph.yml. On every merge to main, and weekly on a schedule, the repository
code graph is extracted and pushed to both watchdog orgs: StageWD
(o9sa30agw, prod cluster) and ProdWD (o5fnr8q65, watchdog cluster).

Why

CR: control-theory/docs#568

Evidence

Distributed by soc2_prep/scripts/distribute-codegraph.sh, which refuses to run
until the composite action exists in control-theory/deploy and all four org-level
values are present. Verify a run afterwards with:

scripts/distribute-codegraph.sh --repo vercelreceiver --verify

That reads the run's warning annotations rather than its conclusion, because the
action is fail-open and always exits 0.

Deployment notes

No runtime change: this adds a workflow, it does not alter the service. Both pushes
are fail-open, so a graph problem cannot break a build or block a merge. Failures
surface as workflow annotations. To back out, delete .github/workflows/codegraph.yml.

Reviewer checklist

• The description above matches the code that is actually merging (no stale design notes)
• Tests cover the change, and CI is green on the final commit
• Security/privacy implications considered (auth on new endpoints, secrets handling, tenant isolation, data in logs)
• Any review comments left on this PR -- human or automated (Copilot) -- are resolved or answered in-thread
• Approver is not the author