Revisit Dependabot automation for github/codeql-action

[N1ghthill]

Problem

On March 30, 2026, the automatic Dependabot update run for the github-actions ecosystem failed on github/codeql-action with an updater-side unknown_error. The rest of the repository baseline remained green.

Proposal

Track the automation failure explicitly and re-enable automated updates for github/codeql-action once the upstream updater bug is no longer reproducing. Until then, keep CodeQL action bumps as a manual maintainer task.

Acceptance Criteria

• the current failure mode is documented with the failing run reference
• repository automation no longer produces recurring red runs for this known upstream failure
• a maintainer path exists for manually updating github/codeql-action
• the ignore can be removed once Dependabot handles the dependency correctly again

References

• failing run: https://github.com/N1ghthill/master-control/actions/runs/23739608881
• workflow: .github/workflows/codeql.yml
• config: .github/dependabot.yml