chore(release): 0.14.0 - #82

## What changed

Code scanning moves from CodeQL default setup to advanced setup, at
`.github/workflows/codeql.yml`. Default setup is already turned off, so
this workflow is what analyzes the repository from here.

The `main` ruleset's `code_quality` rule is removed. `gh api
repos/svyatov/oss-kit/code-quality/setup` answers `404 Code quality is
not available for this repository`, so the rule required a tool that can
never report.

`AGENTS.md` is corrected in both places that described the old
arrangement.

## Why this way

Release pull request #82 passed all six required checks and could not
merge. CodeQL returned `neutral` with `Code scanning cannot determine
the alerts introduced by this pull request, because 1 configuration
present on refs/heads/main was not found`, because the release touches
only JSON and Markdown and there was nothing for `javascript-typescript`
to compare. The ruleset's `code_scanning` rule blocks on that verdict.
Every future release would have hit the same wall, since a release only
ever touches three plugin manifests and the changelog. The workflow
carries no path filter, so a verdict always arrives.

Default setup also excludes fork pull requests, and every external
contribution here arrives from a fork, which is the R-SEC-09 gap
`AGENTS.md` already recorded as open. Advanced setup is what the
`oss-harden` skill names for that case.

The matrix names `actions` and `javascript-typescript` where default
setup reported four languages. `javascript-typescript` is the identifier
that covers both JavaScript and TypeScript, so the other two analyzed
the same tree again.

`code_quality` is removed rather than kept for later because
`skills/oss-harden/references/github.md` already tells a reader not to
add that rule where Code Quality is off, on the grounds that a rule
requiring a tool that never reports blocks every merge. This repository
had done the thing its own skill warns against.

## Verification

The ruleset was backed up before the edit and read back after it.
`target`, `enforcement`, `conditions`, and `bypass_actors` are
unchanged, and the six remaining rules are identical to their previous
values. `bypass_actors` is still `[]` and `current_user_can_bypass` is
still `never`, so nothing here exempts anybody from anything.

`github/codeql-action` is pinned to a full commit SHA resolved through
`skills/oss-harden/scripts/resolve-pin.mjs`, and the job sets
`timeout-minutes`, so the workflow meets R-SEC-01 and R-CI-05.

`bun test` reports 328 passing and `scripts/prose.mjs` reports no
finding on `AGENTS.md`.

## Known gaps

Whether advanced setup delivers a CodeQL verdict on a pull request from
a fork is not verified here, because this branch is not one. R-SEC-09
stays recorded as open on that path until a fork pull request
demonstrates it.

The `CodeQL` context is not in the ruleset's required status checks and
is not added. The `code_scanning` rule is what gates on the analysis,
and it gates on what the analysis found rather than on whether it ran.

## Affects

| Rule or skill | Change |
| --- | --- |
| R-SEC-09 | implementation moves to a workflow file, requirement
unchanged |