ci(codeql): canonical cron weekly→monthly (cut 3, standards#233 Option B) (#286)

## Summary

Single-line cron change in `.github/workflows/codeql.yml`:

```diff
 schedule:
-  - cron: '0 6 * * 1'   # weekly Monday 06:00 UTC
+  - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
```

Owner-decision Option B from #233 (selected 2026-05-30).

## Scope

Canonical caller template only. The ~206-repo estate sweep is tracked
separately; PRs will land staggered to respect GitHub secondary
rate-limit.

## What changes for callers

- Scheduled CodeQL runs go from 52/yr to 12/yr per repo.
- PR-trigger runs (push + pull_request) **unchanged** — every PR still
gets CodeQL.
- Estate-wide budget impact: ~46k Actions-min/yr saved (~85% of
scheduled CodeQL).

## Sweep follow-up

A separate tracking issue will list the 206 repos on `'0 6 * * 1'` for
the per-repo conversion sweep.

Refs #233

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -7,7 +7,12 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    # Estate cut 3 (standards#233): weekly → monthly. 1st of each month
+    # at 06:00 UTC. Owner-decision Option B (2026-05-30): ~85% savings
+    # (~46k Actions-min/yr) with bounded 30-day CVE-detection floor.
+    # PR-trigger runs (push + pull_request) are kept regardless — this
+    # cut only changes the scheduled-baseline cadence.
+    - cron: '0 6 1 * *'
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide