chore(ci): move the CodeQL scheduled scan to monthly

Aligns this repo with the estate convention already landed on 10 of the 21
repos in this family: the scheduled CodeQL backstop runs monthly on the 1st at
06:00 UTC rather than every Monday, to reduce standing pressure on the shared
account-wide Actions quota. PR-triggered analysis is unchanged and still runs
on every pull request against main/master, so changed code is scanned exactly
as before; only the backstop cadence for unchanged code moves.

This is the one benign change carried by the fix/token-permissions-id-20260911
branch in this repo. It is landed here on a clean branch off main because that
branch ALSO deletes guix.scm (71 lines, still live on main and last maintained
on 2026-08-23 by "chore(guix): quality pass" #139). The deletion is unrelated
to token permissions and is the sole cause of that PR's merge conflict, so the
branch cannot be landed as-is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QN8x5x4kNKY8EYCFsCmWB

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide