ci: restore C++ CodeQL analysis (dynamic workflow is python-only since 2026-08-08)

[mvillmow]

Summary

Implements the requested changes for issue #655.

Changes

See the PR diff for the full change set.

Testing

Not run by the automation pipeline.

Closes

Closes #655

Generated by Hephaestus automation

[mvillmow]

Automated PR review

Total grade: A

Review summary: Reviewer validated the implementation responses to all open threads.

Eligibility is represented only by the live GitHub implementation-state label; this audit comment is informational.

Reviewed head: 6f4d422bb6ea9e5e0c7dc335f1a180305105883f.

[mvillmow]

Closing as superseded

C++ CodeQL analysis was already restored on main by a different approach, so this PR and that fix are mutually exclusive.

What landed instead

Commit 0232e1b — "fix(codeql): restore C++ analysis + de-static Google Benchmark functions (#657)" — restored C++ analysis inside the existing required workflow rather than extracting it into a new one:

• .github/workflows/_required.yml:1008 — # Restored from the deleted workflow (c-cpp manual build + python).
• .github/workflows/_required.yml:1023 — - language: c-cpp in the analysis matrix
• .github/workflows/_required.yml:1040-1048 — the C++ manual build steps, gated on matrix.language == 'c-cpp'

main's Analyze (c-cpp/python) check reports success.

Why this conflicts

This PR takes the opposite structural approach: it adds .github/workflows/codeql.yml as a standalone workflow and removes the analyze job from _required.yml. Applying it would undo #657 and drop the check out of the required set — which is exactly the regression #657 was written to fix (see 79e8e0e, "consolidate all workflows into _required.yml so every job is a required check via the homeric-main-baseline ruleset").

Only one of the two designs can hold, and #657's is the one currently merged and enforced by the ruleset.

Related

#661 is a duplicate of this PR — same title, same goal, same approach (adds .github/workflows/codeql.yml). Both are closed together; see #661 for the matching comment.

Verified against origin/main at the time of closing.