ci(codeql): converge to canonical language-autodetect workflow (Refs #8) (#21)

k9iser's codeql.yml was a stale hardcoded `javascript-typescript`-only
matrix (left as a local security workflow by the b618a53 bundle
migration). On this Rust-only repo CodeQL exits with a permanent
false-red 'no source / configuration error' on the analyze job.

Replace it verbatim with the canonical estate template shipped by
rsr-template-repo / v3-templater / reposystem: a detect job reads the
repo's actual language stats and only analyses CodeQL-supported,
buildless-safe languages (here: rust), skipping entirely when none
apply. Also brings the estate concurrency guardrail (cancel superseded
runs). This is resolve-at-source + convergence to the central canonical
template rather than a k9iser-local divergence.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath