ci: add CodeQL scanning (JS/TS + Python)

[DocGerd]

Summary

• Adds .github/workflows/codeql.yml: a CodeQL workflow with job id analyze, running CodeQL scanning for JavaScript/TypeScript and Python on push to main, on pull requests targeting main, and on a weekly schedule (Monday 04:23 UTC).
• Uses build-mode: none for both languages (no compilation needed).
• SHA-pinned actions (actions/checkout@9c091bb2... = v7.0.0, github/codeql-action/{init,analyze}@7188fc36... = v4), least-privilege permissions (contents: read at workflow level, security-events: write added only at job level for uploading results).
• This workflow is deliberately NOT added to required status checks — it's advisory scanning, not a merge gate.

Closes #12

Test plan

• SHA pins re-verified against the live tags on 2026-07-17 (actions/checkout v7.0.0 resolves directly to a commit; github/codeql-action v4 is an annotated tag, dereferenced via the tags API to its commit) — both matched the brief's pinned SHAs exactly, no changes needed.
• This PR's own pull_request trigger runs CodeQL against main for both matrix legs (javascript-typescript, python) — both must succeed before merge; that run is the acceptance evidence.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.