ci(codeql): cron weekly→monthly (cut 3, standards#288) (#28)

Per `standards#286` canonical (cut 3, Option B 2026-05-30): convert
CodeQL scheduled run from weekly `0 6 * * 1` to monthly `0 6 1 * *`.
PR-trigger runs unchanged — every PR still gets CodeQL.

Refs `hyperpolymath/standards#288` (campaign).

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath