ci(codeql): drop the workflow; CodeQL runs as GitHub default setup

.github/dependabot.yml

@@ -27,14 +27,6 @@ updates:
   # "security only, not routine bumps". Pair with the
   # dependabot-automerge.yml workflow for low-touch security
   # maintenance.
-    ignore:
-      # HOLD: github/codeql-action at v4.38.0 (commit b96794f0, held by
-      # .github/workflows/actions.lock). v4.38.1 fails
-      # GitHub workflow-startup validation estate-wide (nexia-list#100;
-      # SHA-form re-bump bypassed versions-scoped ignores - see
-      # nexia-list#101/#104). Hold until upstream clears 4.38.1 or a
-      # newer release verifies green; revisit deliberately.
-      - dependency-name: "github/codeql-action"
 
   - package-ecosystem: "cargo"
     directory: "/"

.github/workflows/README.adoc

@@ -55,7 +55,7 @@ pins), and gitleaks in CI catches a genuine SonarCloud token as `generic-api-key
 
 == SAST tools are complementary, not redundant
 
-* `codeql.yml` — CodeQL (matrix defaults to `actions`; every repo has workflows).
+* CodeQL — GitHub's default setup (repository settings), not a workflow file here.
 * `sonarqube.yml` — SonarCloud (shell / JS surface; see `sonar-project.properties`).
 * `static-analysis-gate.yml` — panic-attack + Hypatia gate (see above).
 

.github/workflows/actions.lock

@@ -5,9 +5,6 @@ version: 'v0.0.2'
 workflows:
     '.github/workflows/build-notification.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/codeql.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.0'
     '.github/workflows/deed-validate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/deed-ecosystem@main'
@@ -200,11 +197,6 @@ dependencies:
         commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
         owner_id: 9919
         repo_id: 259445878
-    'github/codeql-action@v4.38.0':
-        ref: 'v4.38.0'
-        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
-        owner_id: 9919
-        repo_id: 259445878
     'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406':
         ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406'
         commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'