fix(ci): switch CodeQL language matrix to actions

Hypatia flagged the repo's codeql.yml as nominal-only SAST (alerts #25
and #28): the matrix listed `javascript-typescript`, but the repo has
no source files in any CodeQL-scannable language. Every analyze run
therefore exited with "no source files" and recorded zero results,
giving false confidence.

Switch the matrix to `actions` — CodeQL's GitHub Actions analyser
scans workflow files, which every repo has. This makes the SAST
real work instead of theatre.

Closes Hypatia alerts hypatia/scorecard/StaticAnalysis (#28) and
hypatia/workflow_audit/codeql_language_matrix_mismatch (#25).

Refs standards#91 Phase D (HCG hygiene).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: actions
             build-mode: none
 
     steps: