fix(ci): use reusable workflows in standards repo itself

Foundationally consolidates CI workflows by ensuring the standards repo
uses its own reusable workflows:

- codeql.yml: Use codeql-reusable.yml instead of direct CodeQL action calls
- deno-ci.yml: New wrapper using deno-ci-reusable.yml
- elixir-ci.yml: New wrapper using elixir-ci-reusable.yml
- rust-ci.yml: New wrapper using rust-ci-reusable.yml
- changelog.yml: New wrapper using changelog-reusable.yml

This ensures the standards repo practices what it preaches (estate-wide
reusable workflow consolidation) and catches any issues with the
reusables before they propagate to consumer repos.

Also fixed codeql-reusable.yml to include actions: read in job-level
permissions (job-level REPLACES workflow-level, so both must be declared
to ensure CodeQL action has required permissions).

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

.github/workflows/changelog.yml

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Changelog
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - 'CHANGELOG.md'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  generate:
+    uses: ./.github/workflows/changelog-reusable.yml

.github/workflows/codeql-reusable.yml

@@ -78,7 +78,10 @@ jobs:
   analyze:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
+    # Job-level permissions inherit from workflow-level and ADD security-events: write.
+    # Do NOT narrow here or CodeQL action loses `actions: read` which it needs.
     permissions:
+      actions: read
       contents: read
       security-events: write
 

.github/workflows/codeql.yml

@@ -29,36 +29,15 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
-  analyze:
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: javascript-typescript
-            build-mode: none
-          - language: actions
-            build-mode: none
+  analyze-js:
+    uses: ./.github/workflows/codeql-reusable.yml
+    with:
+      language: javascript-typescript
 
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
-        with:
-          category: "/language:${{ matrix.language }}"
+  analyze-actions:
+    uses: ./.github/workflows/codeql-reusable.yml
+    with:
+      language: actions

.github/workflows/deno-ci.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Deno CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deno:
+    uses: ./.github/workflows/deno-ci-reusable.yml

.github/workflows/elixir-ci.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Elixir CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: ./.github/workflows/elixir-ci-reusable.yml

.github/workflows/rust-ci.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Rust CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: ./.github/workflows/rust-ci-reusable.yml