ci: de-gate required-check workflows to run on every PR base

codeql.yml and hypatia-scan.yml restricted their pull_request trigger to
branches:[main,master]. The jobs they run are required status checks, so on a
PR whose base is not main/master the check is never created and the PR is
blocked forever at "Expected — Waiting for status to be reported". Removing the
branch filter makes the required checks report on every PR base; push/schedule
triggers are unchanged. Mirrors the affinescript fix in #645.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXXpaoiATzxcn3kW3eTM26

Author: claude

.github/workflows/codeql.yml

@@ -4,8 +4,10 @@ name: CodeQL Security Analysis
 on:
   push:
     branches: [main, master]
+  # No `branches:` filter — a required check whose workflow is branch-gated is
+  # never created on a non-matching base and blocks merge forever at
+  # "Expected — Waiting for status to be reported" (cf. affinescript#645).
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 6 1 * *'
 

.github/workflows/hypatia-scan.yml

@@ -7,8 +7,10 @@ name: Hypatia Security Scan
 on:
   push:
     branches: [main, master, develop]
+  # No `branches:` filter — a required check whose workflow is branch-gated is
+  # never created on a non-matching base and blocks merge forever at
+  # "Expected — Waiting for status to be reported" (cf. affinescript#645).
   pull_request:
-    branches: [main, master]
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch: