feat(governance): add codeql-reusable.yml — consolidate 263-repo codeql.yml drift (#192)

## Summary

Third foundational reusable in the workflow-convergence sweep (#168 →
#174 → #187 → #190 → this). Targets `codeql.yml`, the 263-deployment
CodeQL security-analysis workflow.

### Drift survey

Full pagination of `gh api /search/code` against `org:hyperpolymath`,
blob-SHA grouped:

| Metric | Value |
|---|---|
| Total deployments | **263** |
| Unique blob SHAs | **69** (26% drift — same as mirror.yml) |
| Top 7 SHAs coverage | **195/263 (74%)** |
| Long-tail SHAs | 62 SHAs / 68 repos |

### Language matrix distribution (key for design)

| Languages | Repos | Share |
|---|---|---|
| `javascript-typescript` only | **223** | **84.8%** |
| `actions` only | 22 | 8.4% |
| NONE (no matrix declared) | 6 | 2.3% |
| `rust` only | 3 | 1.1% |
| `javascript-typescript,rust` | 3 | 1.1% |
| `actions,javascript-typescript` | 3 | 1.1% |
| `actions,javascript-typescript,rust` | 2 | 0.8% |
| `actions,rust` | 1 | 0.4% |

**100% of estate variants use `build-mode: none`** — verified across
rust-only, actions-only, and mixed sampled variants.

### Design choice — single-language single-job reusable

Caller invokes the reusable **once per language**. Multi-language
wrappers (~3.4%) call it multiple times in parallel; per-language SARIF
separation is preserved via the `category: "/language:${{
inputs.language }}"` step.

This matches how callers already think about CodeQL (one job per
language) without forcing a JSON-array input or matrix-as-string-input.
The alternative (matrix-as-input) would have made the 85%
single-language case more awkward.

### Inputs

- `language` (string, default `javascript-typescript`) — single CodeQL
language identifier
- `build-mode` (string, default `none`) — 100% of estate currently uses
`none`; default covers everything
- `runs-on` (string, default `ubuntu-latest`)

### Caller wrapper examples

**Single-language (~85% of estate):**
```yaml
jobs:
  codeql:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
```
~5 lines, replacing ~49.

**Rust-only or actions-only (~10% of estate):**
```yaml
jobs:
  codeql:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: rust
```

**Multi-language (~3.4% of estate):**
```yaml
jobs:
  codeql-js:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
  codeql-actions:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: actions
  codeql-rust:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: rust
```

### Rollout plan

**NOT started in this PR — owner-gated.**

| Wave | Repos | Action |
|---|---|---|
| 1: bulk-mechanical | ~210 | Single-language `javascript-typescript`
default. One-line wrapper. |
| 2: single non-default | ~25 | Override `language: rust` or `language:
actions`. |
| 3: multi-language | ~9 | Two or three reusable invocations per
wrapper. |
| 4: NEEDS_REVIEW | ~18 | `NONE` matrix (6) + 100-line custom workflows
(~2-3). Per-repo review. |

Total expected sweep: ~245 PRs (93% mechanical).

### Pattern hardening

- Same `workflow_call` shape as #168 / #174 / #187 / #190 — no new
infrastructure.
- Independent of all open standards PRs — lands in any order.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: hyperpolymath

.github/workflows/codeql-reusable.yml

@@ -0,0 +1,96 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# codeql-reusable.yml — Reusable CodeQL security-analysis workflow.
+#
+# Consolidates the per-repo `codeql.yml` workflow (estate-wide: 263
+# deployments, 69 unique blob SHAs, 26% structural drift). Language
+# matrix distribution across the estate:
+#
+#   javascript-typescript        223 (84.8%)
+#   actions                       22  (8.4%)
+#   NONE (no matrix declared)      6  (2.3%)
+#   rust                           3  (1.1%)
+#   javascript-typescript,rust     3  (1.1%)
+#   actions,javascript-typescript  3  (1.1%)
+#   actions,javascript-typescript,rust 2 (0.8%)
+#   actions,rust                   1  (0.4%)
+#
+# 100% of estate variants currently use `build-mode: none`.
+#
+# Design: single-language single-job reusable. Multi-language wrappers
+# invoke the reusable once per language (parallel-by-construction).
+# This avoids the matrix-as-input awkwardness while preserving per-
+# language SARIF separation via the `category` step.
+#
+# Caller examples:
+#
+#   # Single-language (~85% of estate):
+#   jobs:
+#     codeql:
+#       uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
+#       # defaults to language=javascript-typescript, build-mode=none
+#
+#   # Rust-only:
+#   jobs:
+#     codeql:
+#       uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
+#       with:
+#         language: rust
+#
+#   # Multi-language (JS/TS + actions + Rust):
+#   jobs:
+#     codeql-js:
+#       uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
+#     codeql-actions:
+#       uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
+#       with:
+#         language: actions
+#     codeql-rust:
+#       uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
+#       with:
+#         language: rust
+
+name: CodeQL Security Analysis (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      language:
+        description: 'CodeQL language identifier (e.g. javascript-typescript, rust, actions). Single language per call; multi-language wrappers invoke the reusable once per language.'
+        type: string
+        required: false
+        default: javascript-typescript
+      build-mode:
+        description: 'CodeQL build mode (none|autobuild|manual). 100% of estate currently uses "none"; override only for compiled languages that require explicit build.'
+        type: string
+        required: false
+        default: none
+      runs-on:
+        description: 'Runner label for the analyze job'
+        type: string
+        required: false
+        default: ubuntu-latest
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    runs-on: ${{ inputs.runs-on }}
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
+        with:
+          languages: ${{ inputs.language }}
+          build-mode: ${{ inputs.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
+        with:
+          category: "/language:${{ inputs.language }}"