ci(codeql): converge to canonical language-autodetect workflow (Refs #8) (#20)

k9iser's codeql.yml was a stale hardcoded `javascript-typescript`-only
matrix (left as a local security workflow by the b618a53 bundle
migration). On this Rust-only repo CodeQL exits with a permanent
false-red 'no source / configuration error' on the analyze job.

Replace it verbatim with the canonical estate template shipped by
rsr-template-repo / v3-templater / reposystem: a detect job reads the
repo's actual language stats and only analyses CodeQL-supported,
buildless-safe languages (here: rust), skipping entirely when none
apply. Also brings the estate concurrency guardrail (cancel superseded
runs). This is resolve-at-source + convergence to the central canonical
template rather than a k9iser-local divergence.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -15,14 +15,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read