ci: analyze this repository with a CodeQL workflow

[dbschmigelski]

Summary

CodeQL never ran on this repository's pull requests: it relied on CodeQL default setup from the org's Profound Base Configuration, and unlike the private repos (lumon, magi-cortex, integration-hub, which all show Analyze (python) / Analyze (actions) checks), nothing was scheduled here — PR #75's checks contain no CodeQL entry at all. This replaces the implicit setup with an explicit workflow, so the trigger lives in the repo and a missing run shows up as a missing job rather than silence.

.github/workflows/codeql.yml analyzes python and actions in a matrix with build-mode: none (neither needs a build), on pushes and pull requests for main and scalar-next, plus a weekly cron so the default branch's results don't go stale between infrequent releases. Job names are Analyze (python) / Analyze (actions), matching the other repos so the org ruleset's CodeQL requirement sees the same shape. security-events: write is scoped to the analyze job, the workflow floor stays contents: read, and actions/checkout runs with persist-credentials: false, following sdk-ci.yml's conventions and SHA pinning style.

Two things outside this diff:

1. Default setup must be disabled in Settings → Code security → CodeQL analysis before this can upload results. While default setup is enabled for the same languages, GitHub rejects SARIF from an advanced configuration.
2. This targets scalar-next, not main: per VERSIONING.md, custom code lives on scalar-next and reaches the default branch through a release PR. The triggers cover both branches, so it also runs on release PRs into main.

Link to Devin session: https://profound.devinenterprise.com/sessions/81b432a57e6443d8ae6276da914f6e90
Open in Devin Desktop: https://profound.devinenterprise.com/desktop/session/81b432a57e6443d8ae6276da914f6e90?variant=devin
Requested by: @dbschmigelski

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@codex please do an in-depth review of this CodeQL workflow. Specifically: whether the pull_request and push trigger set actually covers every path a change reaches main through (generator pushes land on scalar-next, releases arrive as a merge of a release PR), whether build-mode: none is correct for these languages, whether the job-level security-events: write plus workflow-level contents: read floor is sufficient and minimal for SARIF upload on a public repo, and whether the category value keeps results from the two matrix legs separate.

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.