ci(codeql): cron weekly→monthly (cut 3, standards#233 Option B)

Per owner-decision Option B on hyperpolymath/standards#233 (2026-05-30):
move scheduled CodeQL from weekly (`'0 6 * * 1'`) to monthly
(`'0 6 1 * *'`). Same shape as canonical caller-template change
in hyperpolymath/standards#286.

## Why

- ~85% Actions-minute savings on scheduled CodeQL (12 runs/yr vs 52).
- Bounded 30-day CVE-detection floor.
- PR-trigger runs (push + pull_request) unchanged — every PR still gets
  CodeQL coverage.

## Sweep

Part of estate-wide sweep tracked at hyperpolymath/standards#288.

Refs hyperpolymath/standards#233
Refs hyperpolymath/standards#288
Refs hyperpolymath/standards#286

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday
+    - cron: '0 6 1 * *'  # Weekly on Monday
 
 permissions: read-all