CodeQL analysis runs on every PR and on a weekly schedule

## User story

As a **maintainer**, I want **static analysis to run on every PR and surface security issues inline** so that **I learn about a vulnerability from GitHub's Security tab instead of from a user's outage**.

## Why

No CodeQL today. The codebase shells out with `shell=True`, interpolates user input, handles SSH command construction — all canonical CodeQL-detectable patterns. The default Python query set is free and zero-config.

## Acceptance criteria

- [ ] `.github/workflows/codeql.yml` exists using `github/codeql-action/init` + `analyze` with `languages: ['python']`.
- [ ] Runs on `push` to `main`, on `pull_request`, and on a weekly schedule.
- [ ] Uses the `security-and-quality` query suite.
- [ ] Has `permissions: security-events: write, contents: read, actions: read`.
- [ ] Any findings at the time of landing are triaged into either a fix PR or a documented-ignored annotation with justification.

## Out of scope

- Enabling other GitHub Advanced Security features (secret scanning is free and on by default for public repos).

## Notes

- Target release: **none — chore**
- Source: modernization assessment §4.