Make the v1.0.1 CodeQL gate repository-wide

[Coding-Dev-Tools]

Summary

• disable CodeQL diff-informed pull-request analysis so the release gate receives complete raw SARIF
• reject baselined and source-suppressed SARIF results
• sanitize every v2 API exception boundary without returning exception detail
• confine local code indexing to canonical approved roots, with an operator-replaceable ENGRAPHIS_INDEX_ROOTS policy
• preserve the exact deterministic feature-hash vector mapping and native performance

Why

PR #64 eliminated findings in its changed ranges, but the main-branch scan exposed 47 repository-wide results because CodeQL pull-request analysis was diff-informed. The first truly full PR scan then exposed 56 raw Python results, including downstream path and exception flows that the diff scan had omitted. This branch fixes those findings and the gate that allowed them to remain hidden.

The weak-hash result traced from a test variable named secret that held a non-secret receipt-exclusion marker into the compatibility feature mapper. The test now names that value accurately; the non-security feature hash remains byte-identical and keeps native performance.

Verification

• python -m pytest tests/ -q — full suite passed
• ruff check . — clean
• sample and CodeMem retrieval evals — recall@k, hit@k, answer-token recall all 1.0
• ablation — PPR multi-hop recall 1.0 vs vector-only 0.6667
• isolated sdist/wheel build + Twine check — passed
• git diff --check — clean

The required hosted proof is a clean full CodeQL run on this PR followed by a clean main run after merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ebdc23b026

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf4a155d64

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".