Add CodeQL security scanning for JavaScript and TypeScript

### Description

Establish GitHub CodeQL as a native security-scanning baseline for the JavaScript/TypeScript monorepo. Run analysis on pull requests and protected-branch pushes, publish findings to GitHub Security, and review the initial alert baseline before deciding whether CodeQL should become a required merge check.

### Action Items

- [ ] Confirm CodeQL availability and repository security settings.
- [ ] Add a CodeQL workflow for JavaScript/TypeScript analysis.
- [ ] Run scans on pull requests to main and stable, pushes to those branches, and an appropriate schedule.
- [ ] Use the standard security-and-quality query suite with explicit least-privilege permissions.
- [ ] Confirm results upload successfully and are visible in GitHub Security.
- [ ] Review and triage the initial alert baseline, documenting false positives and remediation follow-up.
- [ ] Measure run time and PR experience.
- [ ] Decide and document whether the CodeQL check should become a required status check after baseline review.
- [ ] Verify safe behavior for fork and Dependabot pull requests.

### Additional Information

CodeQL complements existing linting, type checking, unit testing, and any AI or general static-analysis tools; it is specifically a security-focused semantic code scanner.

Do not make CodeQL a required merge check until the initial alert baseline and operational impact have been reviewed.