fix(ci): point CodeQL at 'actions' — repo has no JS/TS source (#42)

## Summary

CodeQL has failed on `main` for every run since 2026-06-24 (6+
consecutive failures, including current HEAD `f39f5a3`). Root cause: the
workflow declared a `javascript-typescript` analysis matrix, but this
repo has **zero** `.js`/`.ts` files. CodeQL then reports *"No source
code was seen during the build"* and exits non-zero.

feedback-o-tron is Elixir-primary (38 `.ex` + 18 `.exs`) with Zig,
Nickel, and Julia support code — CodeQL supports **none** of those
languages. The one CodeQL-supported language actually present is
**`actions`**, which analyses the repo's 15 GitHub Actions workflow
files for CI-security issues (workflow injection, secret exposure,
unpinned actions).

This switches the matrix from `javascript-typescript` to `actions`,
turning the gate green **legitimately** (satisfy the gate, don't disable
it) while adding genuine workflow-security coverage aligned with the
estate's SHA-pinning / CI-hardening posture.

## Change

- `.github/workflows/codeql.yml`: matrix `language:
javascript-typescript` → `language: actions` (keeps `build-mode: none`;
`category` auto-derives to `/language:actions`).

## Verification

- File inventory: `git ls-files | grep -E '\.(js|ts|jsx|tsx)$'` → empty
(confirms no JS/TS to analyse).
- CodeQL run history on `main`: `failure` on the last 6 runs, all "no
source seen".
- `actions` is a first-class CodeQL language in
`github/codeql-action@v3` with `build-mode: none`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UPFC9YQ7g9gc3VnRox42Q1

---
_Generated by [Claude
Code](https://claude.ai/code/session_01UPFC9YQ7g9gc3VnRox42Q1)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -27,7 +27,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # feedback-o-tron is Elixir-primary (Zig/Nickel/Julia support code);
+          # CodeQL supports none of those languages, so a javascript-typescript
+          # matrix found no source and failed every run with "no source seen".
+          # `actions` is the one CodeQL language present here — it analyses the
+          # repo's GitHub Actions workflows for CI-security issues.
+          - language: actions
             build-mode: none
     steps:
       - name: Checkout