ci: de-gate required-check workflows to run on every PR base (#308)

## What

Removes the `pull_request: branches:[main, master]` filter from
`codeql.yml` and `hypatia-scan.yml` so their **required** jobs —
`analyze (actions, none)` / `analyze (rust, none)` and `hypatia /
Hypatia Neurosymbolic Analysis` — report on PRs against **every** base.
`push:` and `schedule:` triggers are unchanged.

## Why

A required status check whose workflow is branch-filtered is never
*created* on a non-matching base, so the PR sits permanently at
*"Expected — Waiting for status to be reported"* — a silent merge block
indistinguishable from a hang.

Observed live on this repo: PR #307 had **no** `hypatia / Hypatia
Neurosymbolic Analysis` and **no** `Hypatia` check at all. This mirrors
hyperpolymath/affinescript#645, which diagnosed and fixed the same
class. No governance change is needed here — this repo still emits
`governance / Validate Hypatia baseline` natively via the `standards`
reusable.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UXXpaoiATzxcn3kW3eTM26

---
_Generated by [Claude
Code](https://claude.ai/code/session_01UXXpaoiATzxcn3kW3eTM26)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -4,8 +4,10 @@ name: CodeQL Security Analysis
 on:
   push:
     branches: [main, master]
+  # No `branches:` filter — a required check whose workflow is branch-gated is
+  # never created on a non-matching base and blocks merge forever at
+  # "Expected — Waiting for status to be reported" (cf. affinescript#645).
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 6 1 * *'
 

.github/workflows/hypatia-scan.yml

@@ -7,8 +7,10 @@ name: Hypatia Security Scan
 on:
   push:
     branches: [main, master, develop]
+  # No `branches:` filter — a required check whose workflow is branch-gated is
+  # never created on a non-matching base and blocks merge forever at
+  # "Expected — Waiting for status to be reported" (cf. affinescript#645).
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch: