ci: remove placeholder API gates and minimize permissions

[dDevAhmed]

Summary

Removes the fake coverage-success step, runs ESLint without modifying the checkout, removes global write permissions, and scopes CodeQL permissions to its job.

Security

Sensitive workflow change. Merge only after all checks pass and a human maintainer approves the exact head SHA.

Tracks V2-BE-044.

[dDevAhmed]

@dDevAhmed merge is blocked for head b031bdd873f64be9619917a7840ca20b83fea8be.

Required fixes:

• Build, Lint, and Test → Check generated artifact drift failed. Run npm ci && npm run build && git status --porcelain; either commit the required reproducible generated output or change the build/generator so CI does not mutate tracked files.
• Security Scans → Dependency audit failed. Run npm audit --audit-level=high, update the lockfile/dependencies or document and implement a narrowly reviewed mitigation—do not suppress the gate.
• Container Vulnerability Scan → Build Docker image failed. Run docker build -t truthbounty-api:test . and fix the Docker build.
• This workflow/security change also has no approving human maintainer review on the current SHA.

Please push a focused fix and include the local command results; the new head will be reviewed from the beginning.