ci: set CodeQL language matrix to actions (no JS/TS source in repo)

codeql.yml declared `javascript-typescript`, but the repo has no JS/TS source,
so the analyze job recorded zero results / failed "no source files" every run.
CodeQL's `actions` language scans the workflow files (present in every repo),
giving real SAST signal. Per the repo's Hypatia workflow_audit finding.

https://claude.ai/code/session_017TXizM5c1Yd9HWf7Y15YH2

Author: claude

.github/workflows/codeql.yml

@@ -31,11 +31,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
-            build-mode: none
-          # Also analyse the GitHub Actions workflows themselves
-          # (CodeQL `actions` language) — directly relevant given the
-          # workflow-hardening in this PR, and closes the Hypatia
+          # CodeQL `actions` language scans the GitHub Actions workflow
+          # files (present in every repo). The repo has no JS/TS source,
+          # so the prior JS/TS matrix entry recorded zero results /
+          # failed "no source files"; closes the Hypatia
           # `codeql_missing_actions_language` finding.
           - language: actions
             build-mode: none