ci: scan application source with CodeQL, not just workflow YAML

[Avicennasis]

CodeQL was scanning language: [actions] — GitHub Actions workflow YAML, and zero lines of this repository's own source.

This was not neglect. Deploying the advanced CodeQL workflow requires disabling code-scanning default setup first (they are mutually exclusive), and that was done fleet-wide on 2026-06-11 per operations/new-github-repo-setup.md. Default setup scans source — so the documented procedure traded real source coverage for actions-only coverage, and that consequence was never written down. Across the 19 repos carrying codeql.yml, 17 were in this state.

The cost was not hypothetical: eldritch-codex had an open js/prototype-pollution-utility alert that went unscanned for ~4 months (fixed in Avicennasis/eldritch-codex#25), and AvicBotChat carries two high-severity py/clear-text-logging-sensitive-data alerts on the same file, one of which recurred two months after the first was fixed — exactly what continuous scanning exists to catch.

Change

Adds this repo's actual source language(s) to the matrix. actions is kept as the floor.

The job name is pinned to Analyze (${{ matrix.language }}) on purpose: GitHub derives an unnamed matrix job's title from all its matrix keys, so adding one later renames the job. Where a branch ruleset requires Analyze (actions), that makes the rule unsatisfiable rather than failing — PRs sit BLOCKED with every check green, and only the merge attempt names the missing context. Cost real time on simsys-logevent#46 and simsys-metrics#83.

Action SHAs are reused verbatim from this repo's existing workflow — none invented.

Upstream fix so this does not regrow: Avicennasis/ClaudeCode#225 makes the /git-standards template language-aware (its policy: replace would otherwise revert this on the next run), plus the wiki section that documents the trade.

Verify by check-run NAME, not just that CodeQL went green — a green Analyze (actions) alone would mean this did not land.