Enable CodeQL analysis for the governance engine

[vitormattos]

Goal

Add semantic static analysis for the TypeScript/JavaScript governance engine as a defense-in-depth control.

Preferred approach

Use GitHub CodeQL default setup if it satisfies the repository's branch/PR coverage. If workflow-based configuration is required, pin all CodeQL actions to immutable full SHAs and use the minimum required permissions.

Scope

• JavaScript/TypeScript analysis;
• pull requests and default branch;
• avoid privileged execution of untrusted PR code;
• make the CodeQL result a required check only after one successful baseline run confirms the exact check context.

Acceptance criteria

• CodeQL runs on the governance engine;
• the configuration follows GitHub's current recommended setup;
• required status-check configuration uses the exact observed check name;
• no unnecessary write permissions are introduced.

[vitormattos]

CodeQL is enabled and passing on the governance engine. The applied Require governance CI ruleset now requires the exact observed CodeQL check context together with DCO, actionlint, REUSE, TypeScript, Vitest and zizmor. The ruleset is active on the default branch, so the remaining acceptance criterion is satisfied.