ci: add CodeQL actions language + presence-gate instant-sync dispatch

Addresses two further Hypatia workflow findings surfaced on the hardening PR:

- codeql.yml (codeql_missing_actions_language): add `language: actions` so
  CodeQL also scans the GitHub Actions workflows themselves (build-mode none).
- instant-sync.yml (secret_action_without_presence_gate): gate the
  repository-dispatch step on the token's presence. `secrets.*` is not usable in
  `if:`, so the secret is surfaced via a job-level env var and the step is
  skipped when the token is absent (forks / secret not configured) instead of
  failing. Behaviour is unchanged on the main repo where the secret is set.

Left intentionally untouched: scorecard.yml's reusable-workflow permissions
(the called workflow lives in hyperpolymath/standards, out of scope here, and is
already being reworked on another branch) and the pre-existing code-safety
findings (Idris2 believe_me axioms — deliberately kept and gated per #152; Agda
funext postulate; ReScript Obj.magic; Rust FFI unsafe blocks), none of which are
in this PR's diff.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KfgJznd6jzSeDYsSXGAXkU

Author: claude

.github/workflows/codeql.yml

@@ -35,9 +35,12 @@ jobs:
           # was removed: the repo contains zero JS/TS sources (TypeScript/Node
           # are banned by the language policy), so CodeQL's JS/TS extractor
           # found no code and the job failed with a configuration error. `cpp`
-          # covers the real C sources (Elixir NIF, OCaml/Lean wrapper, Zig FFI).
+          # covers the real C sources (Elixir NIF, OCaml/Lean wrapper, Zig FFI);
+          # `actions` scans the GitHub Actions workflows themselves.
           - language: cpp
             build-mode: none
+          - language: actions
+            build-mode: none
 
     steps:
       - name: Checkout

.github/workflows/instant-sync.yml

@@ -15,11 +15,17 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    # Presence-gate the dispatch on the secret: `secrets.*` is not usable in
+    # `if:`, so surface it via a job-level env var and skip the step when the
+    # token is absent (forks / secret not configured) instead of failing.
+    env:
+      FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
     steps:
       - name: Trigger Propagation
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
-          token: ${{ secrets.FARM_DISPATCH_TOKEN }}
+          token: ${{ env.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm
           event-type: propagate
           client-payload: |-