ci(repo): fix CodeQL workflow - Rust needs build-mode none

[saagpatel]

What

Fix two bugs in .github/workflows/codeql.yml that I introduced in Wave 3 (#30) and that caused both matrix jobs to fail on every run since.

Change 1: Rust matrix build-mode: manual → build-mode: none. CodeQL's Rust support hard-rejects manual mode with:

A fatal error occurred: Rust does not support the manual build mode.
Please try using one of the following build modes instead: none.

Change 2: Drop cache: "pnpm" from actions/setup-node on the JS matrix. With build-mode: none we never run pnpm install, so the cache post-step tries to save from a nonexistent path and fails with:

Path(s) specified in the action for caching do(es) not exist,
hence no cache is being saved.

Also drop the now-unused Install Rust, Setup pnpm, and Build Rust (manual mode) steps.

Why

Caught these while verifying the post-Wave-4 state before Wave 5. The bugs have been failing on every master push since #30 landed (both matrix jobs red). No SARIF uploaded, so the Security tab has nothing to show.

With this fix, CodeQL will actually run — which was the whole point of Wave 3.

How

One commit. 6 insertions, 24 deletions. No other workflows touched.

Testing

• Commands run: YAML parsed via js-yaml (OK); matrix inspected (two entries, both build-mode: none)
• Results: CI on this PR will be the real validation — both matrix jobs should complete Perform CodeQL Analysis and upload SARIF

Performance impact

• Bundle delta: N/A (CI workflow)
• Build time delta: none on master; CodeQL run wall-clock unchanged (same analyze step)
• Lighthouse delta: none
• API latency delta: none
• DB query delta: none

Risk / Notes

• Low risk: fixes a workflow that hasn't been producing any signal since it was added
• If CodeQL's Rust extractor reports new findings that weren't visible before (because the job never got past init), those need to be triaged in docs/security/codeql-baseline.md as part of baseline capture

Screenshots (UI only)

• N/A

Lockfile rationale (if lockfile changed)

• No lockfile changes.

🤖 Generated with Claude Code