ci: audit no-codeql org baseline

[haasonsaas]

Summary

• add a live no-CodeQL lane to the engineering-practices audit
• verify EvalOps security config 245233 remains default for new repos with GitHub default code scanning disabled
• flag CodeQL drift if workflow files, branch protection, or org rulesets reintroduce CodeQL/default code scanning

Production Signal

Live org evidence from May 21, 2026:

• code_scanning_default_setup=disabled on enforced EvalOps security config 245233
• default_for_new_repos=all
• assigned_repository_count=88
• zero sampled repo assignment gaps
• zero CodeQL workflow matches
• zero CodeQL required-check matches

Rollback

Revert this PR. The existing static org-control-plane CodeQL prohibition remains in place, so rollback only removes the new live audit lane/report fields.

Test Plan

• ruby -Itest -e 'ARGV.each { |path| require "./#{path}" }' test/audit_engineering_practices_test.rb test/verify_org_control_plane_contract_test.rb
• ruby .github/scripts/audit-engineering-practices.rb --contract-only --json-output /tmp/engineering-practices-contract.json --markdown-output /tmp/engineering-practices-contract.md
• ruby .github/scripts/audit-engineering-practices.rb --json-output /tmp/engineering-practices-audit.json --markdown-output /tmp/engineering-practices-audit.md
• ruby -Itest -e 'ARGV.each { |path| require "./#{path}" }' test/*_test.rb
• git diff --check
• gh search code 'github/codeql-action org:evalops path:.github/workflows' --json repository,path --limit 100 -> []
• gh search code 'codeql org:evalops path:.github/workflows' --json repository,path --limit 100 -> []