ci: ca-pi-codeql absent from ci-passed merge gate (infra-001)

[SUaDtL]

Branch: feat/pi-support · Tribunal run 2026-07-17-pi-support-branch · Finding: findings/infra/infra-001.json
.github/workflows/ci.yml:829-867 — ca-pi-codeql is not in ci-passed needs/required_results; branch protection requires only Merge readiness and the job uses upload:never, so its findings gate nothing. Fix: add it with skipped-is-ok handling like other conditional jobs.

[SUaDtL]

Verified against PR #313 head 9ed248f4: .github/workflows/ci.yml now includes ca-pi-codeql in both ci-passed.needs and required_results, with success or skipped handling consistent with the other conditional jobs. The hosted Pi security-analysis check and final merge-readiness gate are green. This finding is implemented on #313, which now carries Closes #314.