ci: cut the per-push job fan-out that queues CI behind the runner limit - #1508

🟢 Confidence 9/10 · safe to merge
Ran the new matrix jq for empty, one- and four-language change sets; the legs match the description and no other job behaviour changed.
_{quality 100/100 · no findings · tests not needed · risk low}

Path-filters CodeQL's Rust/Go/Python/Actions legs on PRs and packs the Bun suites into the existing test lanes, to cut the per-push job fan-out. The workflow change reproduces the removed five-language matrix on every non-PR event, so it is safe to merge.

• codeql.yml builds the analyze matrix from paths-filter's changes output
• PRs analyze Rust/Go/Python/Actions only when their paths change
• Push, schedule and dispatch keep the previous five-language matrix
• Bun suites pack into the small test lanes via a second Turbo invocation

Before merge

• Manual · Confirm no ruleset or merge protection requires an Analyze (...) check a skipping PR would leave pending

_{5f64e26 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}