ci(codeql): build the Go leg explicitly instead of autobuild (REL-12)

[phsb5321]

Slice brief wa-eng (w8:p2) — REL-12 (/tmp/sp-dispatch/wa-brief-rel12.md). Huly 6a75e2505b05a27b0b06a819.

The finding (cited file:line)

.github/workflows/codeql.yml:30 — the Go matrix leg set build-mode: autobuild. CodeQL autobuild guesses how the project builds; when the guess is wrong it silently analyses a partial call graph, and the security gate returns a green check with missed alerts — the worst failure mode for a gate whose entire point is that green means coverage. issues.md REL-12 (LOW).

The fix

• Go leg (codeql.yml:30): build-mode: autobuild → build-mode: manual.

• New build step between init and analyze, guarded to the Go leg only:

  - name: Build (CodeQL manual mode)
    if: matrix.language == 'go'
    env:
      CGO_ENABLED: 0
    run: go build ./...

  CGO_ENABLED=0 keeps the repo-wide CGO-free invariant — the analysed artifact is the same one the release builds. The if: guard means the actions leg (:32, build-mode: none, workflow-YAML analysis with no build) does not run it.

• actions leg: unchanged (build-mode: none remains correct).

• Every SHA pin + # vX.Y.Z comment byte-identical; no action versions bumped, no permissions: change, no new jobs, no paths-ignore/query-suite narrowing.

Verification

• actionlint 1.7.12 — clean.
• zizmor 1.24.1 --persona=auditor — clean (this job runs on ubuntu-latest, so the self-hosted-runner exception is not involved).
• Pre-push hooks (test-race, gitleaks, actionlint, zizmor) — passed on push.
• CI gates pending on the PR: CodeQL (go) (must show the Build step in the run log, not skipped), CodeQL (actions) (must stay green on none), workflow static analysis.

Acceptance-gate checklist (brief's falsifier)

• CodeQL (go) green with build-mode: manual and the go build ./... step visible in the run log (pending)
• CodeQL (actions) green, still build-mode: none (pending)
• no new alerts; if any appear they are a real finding to report, not suppress
• diff touches .github/workflows/codeql.yml only
• workflow static analysis — actionlint + zizmor verified clean locally
• PR body cites file:line and states the merge class (below)

Merge class

[pending] Pedro: merge #333 — this PR touches .github/workflows/ → Actions class, gated per AGENTS.md R33. Not self-merging; same handling as #325/#326.

Revert path: git revert <merge-sha> — one-file additive change.

Note on a sibling worktree

wa-333-audit-sweep (a sibling session's worktree) contained an uncommitted, unpushed draft of the same REL-12 change (verified: same shape — manual + guarded go build + CGO_ENABLED: 0). To avoid two competing PRs for one fix, this PR is the single landed change; the sibling's draft was left untouched in its own worktree. If that sibling is still mid-task, the duplicate is this one — please close/coordinate via the orch seat.

[phsb5321]

Closing as a duplicate of #334 — not a quality judgement, a collision: two seats picked up REL-12 in parallel (my dispatch went to w8:p2, and the audit-sweep slice reached the same finding independently).

Both carry a byte-equivalent codeql.yml change (build-mode: manual + if: matrix.language == 'go' guarded CGO_ENABLED=0 go build ./...). #334 is a strict superset: it also closes the REL-12 and REL-13 rows in issues.md, which is the other half of the audit ledger being true.

Keeping #334, per the ownership rule (take over one, close the duplicate — never park both). Nothing from this PR is lost.