ci: CodeQL language matrix -> actions #386

Job	Run time
governance / Code quality + docs	35s
governance / Guix primary / Nix fallback policy	33s
governance / Well-Known (RFC 9116 + RSR)	41s
governance / Security policy checks	30s
governance / Licence consistency	32s
governance / Workflow security linter	36s
governance / Language / package anti-pattern policy	37s
governance / Validate Hypatia baseline	38s
governance / Trusted-base reduction policy	36s
	5m 18s

Provide feedback