fix(ci): repair codeql.yml — GitHub cannot parse it, so it has never run

This workflow file is invalid YAML. GitHub refuses it at parse time, so it
produces NO run, NO check-run, NO annotation and NO log. Not a red X — an
absence. Nothing on a dashboard distinguishes "this gate passed" from "this
gate does not exist", which is why it went unnoticed.

The tell is the Actions API reporting the workflow's name as its FILE PATH
instead of its `name:` — GitHub registers a file it cannot parse under its
path:

    name = ".github/workflows/codeql.yml"
    path = ".github/workflows/codeql.yml"        <- name == path

The repair is purely positional; no step, command or argument is altered.
Depending on the file it is one of:

  * a step appended at JOB level (2-space indent) moved back inside the
    preceding job's `steps:` list; or
  * a multi-line shell string whose continuation fell out of its `run: |`
    block scalar, re-indented so it stays inside. YAML strips that indent
    again when parsing, so the shell receives the identical string.

VERIFIED before push, not assumed:
  * the file parses and yields a `jobs:` mapping;
  * every `- name:` present before is still a step after;
  * exactly one file changed.

Part of a measured estate-wide repair: 211 invalid workflow files across 116
repos, confirmed by the Actions API.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           category: "/language:${{ matrix.language }}"
 
-  - name: K9-SVC Validation
-    run: |
-      echo "K9-SVC validation"
-      [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"
+      - name: K9-SVC Validation
+        run: |
+          echo "K9-SVC validation"
+          [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"