chore(ci): move CodeQL to a checked-in advanced-setup workflow

[jdwillmsen]

Why

prune-actions-cache.yml exists only to clean up after default-setup CodeQL, which writes its Java/Go dependency cache under content-hash keys that never repeat. Advanced setup leaves dependency-caching off by default, so the bloat stops at the source and the prune workflow can go.

Measured (2026-08-29)

• Prune workflow, last 28 days: 447 runs = 112 runs/week, 25 wall-min/week, ~119 billed runner-min/week (each run ~10 s, billed per started minute). 445 success / 2 failure.
• Actions cache now: 5.83 GiB across 105 entries; 25 codeql-* entries = 3.88 GiB (67%), individual codeql-dependencies-1-Linux-java-* entries 252-303 MiB, three per open PR ref even with hourly pruning.
• Default setup: state=configured, languages actions/go/java-kotlin/javascript-typescript, query suite default, threat model remote, schedule weekly. A second dynamic workflow (github-code-quality/codeql, Code quality default setup) also runs and is left alone: codeql-action rejects the analysis-kinds input in custom workflows (GitHub-internal), so code quality cannot be folded in here. It has 0 open findings; whether it keeps running is the reviewer's call (step 2b).
• Per-push cost is unchanged: default setup jobs took 47-136 s per language (security) plus 53-87 s (quality); this workflow runs the same four extractors once.
• Open CodeQL alerts: 0. Open alerts total 2, both Trivy (low), untouched by this change. Closed CodeQL history: 2 closed (1 dismissed, 1 fixed) - closed alerts are not deleted by a setup switch. Category stays /language:<name>, the same analysis origin default setup used.

Open alert snapshot (pre-merge)

[{"number":58,"tool":"Trivy","rule":"DS-0026","severity":"low","state":"open","category":".github/workflows/security-scan.yml:scan","url":"https://github.com/jdwlabs/apps/security/code-scanning/58"},{"number":56,"tool":"Trivy","rule":"DS-0026","severity":"low","state":"open","category":".github/workflows/security-scan.yml:scan","url":"https://github.com/jdwlabs/apps/security/code-scanning/56"}]

Post-merge manual steps (reviewer)

1. Re-snapshot open alerts: gh api "repos/jdwlabs/apps/code-scanning/alerts?state=open&per_page=100" --jq '[.[]|{number,tool:.tool.name,state}]' and compare with the JSON above.
2. Disable default setup so the workflow's uploads are accepted (confirmed on this PR's first run: "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled", so the Analyze (*) checks stay red until this step is done): gh api -X PATCH repos/jdwlabs/apps/code-scanning/default-setup -f state=not-configured.
   2b. Decide on Code quality default setup (Settings > Code security > Code quality; no REST endpoint). It also runs a Java extractor, so if codeql-dependencies-* entries keep appearing after step 3, that is where they come from and it should be switched off too.
3. Run gh workflow run codeql.yml --repo jdwlabs/apps and confirm four green Analyze (...) jobs and that no new codeql-dependencies-* cache entry appears: gh api "repos/jdwlabs/apps/actions/caches?key=codeql-dependencies-1-Linux-java" --jq .total_count should stop growing.
4. Existing codeql-* entries (3.88 GiB) age out via GitHub's 7-day eviction; delete by hand if pnpm/Gradle evictions are seen before then.

Pinned with the house full vMAJOR.MINOR.PATCH tag convention (see docs/ci-standards.md in jdwlabs/.github) on codeql-action v4, since v3 is deprecated. Companion docs PR in jdwlabs/.github updates the workflow inventory and the code-scanning strategy.

Refs JDWLABS-450.

🤖 Generated with Claude Code

https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6