ci: add estate-standard CodeQL workflow (unblocks code-scanning merge gate)

arghda-core's `main` branch protection requires Code Scanning results, but
the repo shipped no CodeQL workflow — so auto-merge waits forever
("Waiting for Code Scanning results. Code Scanning may not be configured
for the target branch"). Earlier PRs only merged because the owner merged
them manually; auto-merge enforces the gate strictly.

Root cause: arghda-core was EXTRACTED from echo-types rather than
instantiated from rsr-template-repo, so it never inherited the template's
`codeql.yml`. This restores the canonical estate workflow verbatim
(identical to rsr-template-repo + cicd-squabbler, which is green):

- `language: actions`, `build-mode: none` — the estate default; scans the
  workflow files every repo has, avoiding the "no source files" failures
  that `rust`/`javascript-typescript` extractors produce (CodeQL's Rust
  support is limited). Per hypatia `codeql_language_matrix_mismatch`.
- Triggers on `push: [main]` (establishes the code-scanning BASELINE on the
  target branch — the missing piece the error names) AND `pull_request`
  (produces results on every PR). SHA-pinned actions.

Permanent fix: once this lands on `main`, the push-trigger run establishes
the baseline and every future PR's code-scanning gate is satisfied
automatically — no more manual-merge workaround.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012MpYSh6Wy8YMBH2E3qVyT7

Author: claude

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: MPL-2.0
+name: CodeQL Security Analysis
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  schedule:
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC (Actions burn cut, standards#288)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Default to `actions` — scaffolded repos rarely have JS/TS
+          # source; `javascript-typescript` produced "no source files"
+          # failures on every CodeQL run. The `actions` extractor scans
+          # workflow files which every repo has. Override per-repo if
+          # the scaffolded project actually contains JS/TS code.
+          # Per hypatia rule `codeql_language_matrix_mismatch`.
+          - language: actions
+            build-mode: none
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
+        with:
+          category: "/language:${{ matrix.language }}"