ci: move code scanning to CodeQL advanced setup

[svyatov]

What changed

Code scanning moves from CodeQL default setup to advanced setup, at .github/workflows/codeql.yml. Default setup is already turned off, so this workflow is what analyzes the repository from here.

The main ruleset's code_quality rule is removed. gh api repos/svyatov/oss-kit/code-quality/setup answers 404 Code quality is not available for this repository, so the rule required a tool that can never report.

AGENTS.md is corrected in both places that described the old arrangement.

Why this way

Release pull request #82 passed all six required checks and could not merge. CodeQL returned neutral with Code scanning cannot determine the alerts introduced by this pull request, because 1 configuration present on refs/heads/main was not found, because the release touches only JSON and Markdown and there was nothing for javascript-typescript to compare. The ruleset's code_scanning rule blocks on that verdict. Every future release would have hit the same wall, since a release only ever touches three plugin manifests and the changelog. The workflow carries no path filter, so a verdict always arrives.

Default setup also excludes fork pull requests, and every external contribution here arrives from a fork, which is the R-SEC-09 gap AGENTS.md already recorded as open. Advanced setup is what the oss-harden skill names for that case.

The matrix names actions and javascript-typescript where default setup reported four languages. javascript-typescript is the identifier that covers both JavaScript and TypeScript, so the other two analyzed the same tree again.

code_quality is removed rather than kept for later because skills/oss-harden/references/github.md already tells a reader not to add that rule where Code Quality is off, on the grounds that a rule requiring a tool that never reports blocks every merge. This repository had done the thing its own skill warns against.

Verification

The ruleset was backed up before the edit and read back after it. target, enforcement, conditions, and bypass_actors are unchanged, and the six remaining rules are identical to their previous values. bypass_actors is still [] and current_user_can_bypass is still never, so nothing here exempts anybody from anything.

github/codeql-action is pinned to a full commit SHA resolved through skills/oss-harden/scripts/resolve-pin.mjs, and the job sets timeout-minutes, so the workflow meets R-SEC-01 and R-CI-05.

bun test reports 328 passing and scripts/prose.mjs reports no finding on AGENTS.md.

Known gaps

Whether advanced setup delivers a CodeQL verdict on a pull request from a fork is not verified here, because this branch is not one. R-SEC-09 stays recorded as open on that path until a fork pull request demonstrates it.

The CodeQL context is not in the ruleset's required status checks and is not added. The code_scanning rule is what gates on the analysis, and it gates on what the analysis found rather than on whether it ran.

Affects

Rule or skill	Change
R-SEC-09	implementation moves to a workflow file, requirement unchanged