codeql: suppress py/ineffectual-statement (false positives)

Adds ``.github/codeql/codeql-config.yml`` with a query-filter
exclude for ``py/ineffectual-statement``. The rule has produced
zero true positives across the codebase; every finding has been
the same false-positive pattern:

- PEP 544 ``Protocol`` method bodies (``...``) on the eight
  Protocol classes the framework defines (``Provider``,
  ``Checkpointer``, ``Middleware``, ``Observer``, etc.). Canonical
  Python idiom — never executed.
- ``await worker`` lines flagged as no-effect when ``await`` on
  a task is the entire mechanism that waits for the task to
  complete (CodeQL bug on async patterns).

The genuine "unused statement" cases are caught at type-check time
by pyright's ``reportUnusedExpression`` — suppressing the CodeQL
rule doesn't lose any signal.

To make GitHub's default-setup code scanning honor this config:
Settings → Code security → Code scanning → CodeQL default setup →
"Custom configuration" → point at
``.github/codeql/codeql-config.yml``. (Or switch to advanced
setup; the file works either way once selected.)

Author: chris-colinsky

.github/codeql/codeql-config.yml

@@ -0,0 +1,30 @@
+name: "openarmature-python CodeQL config"
+
+# CodeQL's Python ``code-quality`` suite includes
+# ``py/ineffectual-statement``, which produces a fixed false-positive
+# stream against this codebase:
+#
+# - PEP 544 ``Protocol`` method bodies use ``...`` (the canonical
+#   Python idiom — never executed because Protocols are structural,
+#   not inheritance-based). Replacing with ``raise NotImplementedError``
+#   would imply ABC semantics that the protocol classes
+#   intentionally don't have. Cited sites:
+#     - ``llm/provider.py`` (Provider.ready / complete)
+#     - ``checkpoint/protocol.py`` (Checkpointer.save / load / list /
+#       delete)
+#     - ``graph/middleware/_core.py`` (Middleware.__call__ + chain
+#       callable)
+#     - ``graph/observer.py`` (Observer.__call__)
+# - ``await worker`` after a queue sentinel in
+#   ``tests/unit/test_observer.py`` is flagged as no-effect, but
+#   ``await`` on a Task waits for completion — the entire reason
+#   the line exists. CodeQL bug for async patterns.
+#
+# Each finding has been individually triaged across PR review rounds;
+# the rule has produced zero true positives. Suppressing the rule
+# repo-wide stops the regenerating noise without leaving real
+# unused-statement bugs un-caught (pyright's ``reportUnusedExpression``
+# already covers the genuine cases at type-check time).
+query-filters:
+  - exclude:
+      id: py/ineffectual-statement