ci(security): add CodeQL code-scanning workflow

[avrabe]

Closes the no-code-scanning security gap. The repo runs cargo-audit for dependency CVEs but had no static analysis of its own source. CodeQL supports Rust; results surface under Security → Code scanning.

Runs on push/PR to main + weekly. No untrusted input in any run: step.

Two maintainer-admin actions still needed (I can't toggle these):

• Enable Dependabot alerts — currently disabled (Settings → Code security)
• Enable Code scanning in repo settings so CodeQL alerts surface

Part of the security hardening (with the merge gate #378).

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

🔍 Build Diagnostics Report

Summary

Metric	Base Branch	This PR	Change
Errors	0	0	0
Warnings	5	5	0

🎯 Impact Analysis

Issues in Files You Modified

• 0 new errors introduced by your changes
• 0 new warnings introduced by your changes
• 0 total errors in modified files
• 0 total warnings in modified files
• 0 files you modified

Cascading Issues (Your Changes Breaking Other Files)

• 0 new errors in unchanged files
• 0 new warnings in unchanged files
• 0 unchanged files now affected

Note: "Cascading issues" are errors in files you didn't modify, caused by your changes (e.g., breaking API changes, dependency issues).

✅ No Issues Detected

Perfect! Your changes don't introduce any new errors or warnings, and don't break any existing code.

---

📊 Full diagnostic data available in workflow artifacts

🔧 To reproduce locally:

# Install cargo-kiln
cargo install --path cargo-kiln

# Analyze your changes
cargo-kiln build --output json --filter-severity error
cargo-kiln check --output json --filter-severity warning

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!