chore(ci): move the CodeQL scheduled scan to monthly (#72)

Lands the one benign change carried by
`fix/token-permissions-id-20260911` in this repo, without the
destructive part of that branch.

## The change

```diff
 schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
```

The scheduled CodeQL backstop moves from weekly to monthly, matching the
estate convention already landed on 10 of the 21 repos in this family,
to reduce standing pressure on the shared account-wide Actions quota.
**PR-triggered analysis is untouched** and still runs on every pull
request against `main`/`master`, so changed code is scanned exactly as
before — only the cadence of the backstop over *unchanged* code moves.

## Why this is a new branch rather than PR #69

PR #69 was authorised to land on the understanding that its residual
against main was this single line. It is not. Measured:

```
 .github/workflows/codeql.yml |  2 +-
 guix.scm                     | 71 --------------------------------------------
```

`guix.scm` is **still live on main** (691 bytes, last maintained
2026-08-23 by "chore(guix): quality pass — fix stub/invalid names"
#139), and a trial merge shows it is the **only** conflicted path — the
unrelated file deletion is the entire reason that PR cannot merge.
Landing #69 as-is would have removed a maintained file from main under a
title about token permissions.

So the authorised intent is delivered here, and #69 is closed with the
rest of the family.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_014QN8x5x4kNKY8EYCFsCmWB

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Author: 3 people

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide

.machine_readable/6a2/AGENTIC.a2ml …chine_readable/descriptiles/AGENTIC.a2ml.machine_readable/6a2/AGENTIC.a2ml renamed to .machine_readable/descriptiles/AGENTIC.a2ml .machine_readable/6a2/AGENTIC.a2ml renamed to .machine_readable/descriptiles/AGENTIC.a2ml

@@ -156,13 +156,13 @@ All machine-readable metadata lives here (never in root).
 [width="100%",cols="40%,60%",options="header",]
 |===
 |Path |Purpose
-|`+.machine_readable/6a2/STATE.a2ml+` |Project state: scaffold phase, 5%
+|`+.machine_readable/descriptiles/STATE.a2ml+` |Project state: scaffold phase, 5%
 complete
 
-|`+.machine_readable/6a2/META.a2ml+` |Architecture decisions:
+|`+.machine_readable/descriptiles/META.a2ml+` |Architecture decisions:
 iser-pattern, ABI-FFI standard, RSR template
 
-|`+.machine_readable/6a2/ECOSYSTEM.a2ml+` |Ecosystem position: -iser
+|`+.machine_readable/descriptiles/ECOSYSTEM.a2ml+` |Ecosystem position: -iser
 family, siblings (typedqliser, chapeliser, verisimiser)
 
 |`+.machine_readable/CLADE.a2ml+` |Clade taxonomy classification

.machine_readable/6a2/ECOSYSTEM.a2ml …ine_readable/descriptiles/ECOSYSTEM.a2ml.machine_readable/6a2/ECOSYSTEM.a2ml renamed to .machine_readable/descriptiles/ECOSYSTEM.a2ml .machine_readable/6a2/ECOSYSTEM.a2ml renamed to .machine_readable/descriptiles/ECOSYSTEM.a2ml

@@ -154,8 +154,8 @@ For k9-svc managed deployments:
 
 [source,bash]
 ----
-# Validate the deployment component
-nickel typecheck container/deploy.k9.ncl
+# Validate the deployment component (strip its required K9! marker first)
+nickel typecheck <(tail -n +2 container/deploy.k9.ncl)
 
 # Deploy (requires Hunt-level authorisation)
 k9-svc deploy container/deploy.k9.ncl --env production

.machine_readable/6a2/META.a2ml .machine_readable/descriptiles/META.a2ml.machine_readable/6a2/META.a2ml renamed to .machine_readable/descriptiles/META.a2ml

@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level)
 #
@@ -8,7 +9,7 @@
 # It requires explicit authorisation via the Leash system.
 #
 # Usage:
-#   nickel typecheck container/deploy.k9.ncl
+#   nickel typecheck <(tail -n +2 container/deploy.k9.ncl)
 #   k9-svc validate container/deploy.k9.ncl
 #   k9-svc deploy container/deploy.k9.ncl --env production
 
@@ -143,7 +144,12 @@ echo "K9: Rollback complete."
 
 # Export the component
 {
-  pedigree = component_pedigree,
+  pedigree = component_pedigree & {
+    name = "{{SERVICE_NAME}}-deploy",
+    version = "{{VERSION}}",
+    leash = 'Hunt,
+    signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT",
+  },
   deployment = deployment,
   scripts = scripts,