ci(security): gate mainline on CodeQL JS/TS code scanning with security-extended queries

[bradsaucier]

Summary

Adds GitHub CodeQL JavaScript/TypeScript code scanning as a required merge gate, closing the last credible gap in OpsNormal's security posture: there is currently no source-level static analysis. Dependency-level audit (npm audit --audit-level=high), CSP directive drift, build provenance attestation, and the fail-closed import commit proof already exist. CodeQL extends that discipline to the application source.

What changes

• New workflow .github/workflows/codeql.yml, pinned to immutable action SHAs, running security-extended and security-and-quality query packs on every PR, every push to main, and weekly on main.
• New ADR-0028 recording the decision, alternatives, triage policy, and failure model.
• SECURITY.md, README.md, docs/test-plan.md, and docs/decisions/README.md updated so the new gate stays visible.
• CHANGELOG.md [Unreleased] -> Security entry.

What this does not change

No application source is modified. ci.yml, deploy.yml, Playwright projects, coverage thresholds, the CSP directive contract, Trusted Types policy, and release artifact reuse are all untouched. This PR is additive.

Why this gate

SECURITY.md already scopes security review to import validation, undo verification, data-integrity, CSP bypass, and service-worker correctness. Those categories are exactly what the CodeQL JS/TS query packs are designed to find. Adding the gate makes the stated scope machine-enforced on every PR instead of review-dependent.

See ADR-0028 for decision context and triage policy.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.