Add CodeQL static analysis workflow

## Summary

**Gap:** CodeQL is still not configured; tracked as a follow-up so static analysis covers more than dependency alerts.

## Context

We now have Dependabot active for npm + GitHub Actions, and `npm audit` on main is down to **0** after recent remediation work. Dependency scanning alone is not enough — CodeQL would add SAST coverage for the website (JS/TS) and workflow/config surfaces.

Related recent work:
- Dependabot remediation: https://github.com/IntersectMBO/developer-experience/pull/286 · https://github.com/IntersectMBO/developer-experience/issues/285
- Remaining `image-size` patch: https://github.com/IntersectMBO/developer-experience/pull/295 · https://github.com/IntersectMBO/developer-experience/issues/294
- Dependabot config: https://github.com/IntersectMBO/developer-experience/blob/main/.github/dependabot.yml

## Proposal

1. Add a GitHub Actions CodeQL workflow under `.github/workflows/` (e.g. `codeql.yml`).
2. Enable analysis for `javascript-typescript` (primary stack for `website/`).
3. Run on:
- `push` to `main`
- `pull_request` targeting `main`
- weekly `schedule` (recommended default)
4. Confirm results appear under the repo **Security → Code scanning** tab.
5. Optionally tune query suite (`security-extended` / default) once baseline noise is understood.

## Acceptance criteria

- [ ] CodeQL workflow merged and running green on `main`
- [ ] Code scanning alerts visible in GitHub Security
- [ ] Docs/notes updated if triage process should mention CodeQL alongside Dependabot (`TRIAGE.md` if appropriate)

## Priority

Medium — closes a known maintainer security gap after dependency remediation.

Start by reviewing .github/dependabot.yml and existing files under .github/workflows to understand the repository's GitHub Actions conventions. Add a CodeQL workflow for javascript-typescript on pushes and pull requests targeting main, plus a weekly schedule. Confirm the workflow runs green on main and that alerts appear in Security → Code scanning; update TRIAGE.md only if needed.

Written by the indexing model from the issue text.