feat(ci): add CodeQL code scanning; make code-scanning workflows private-safe

[JartanFTW]

Summary

Adds CodeQL (SAST) — the one missing layer alongside zizmor (workflow lint), scorecard (supply chain), dependabot + pip-audit (deps), actionlint. Also closes a gap the addition exposed: code-scanning workflows now skip cleanly on a private fork instead of failing the SARIF upload, so a forker who doesn't delete them isn't greeted by red runs.

What changed

1. .github/workflows/codeql.yml (new) — CodeQL on push/pull_request (main) + weekly schedule (Mon 07:30 UTC, offset from scorecard/link-check). Python matrix with build-mode: none; reuses the github/codeql-action@v3.36.3 pin already present in scorecard.yml.
2. .github/workflows/scorecard.yml — same visibility guard added so it also skips (not fails) on private forks; the stale "set false on a private fork" note is gone.
3. README.md — CodeQL added to the workflow inventory; checklist reconciled (see below).

Private-safe design

Each workflow gets a tiny visibility guard job that resolves repo visibility via gh api repos/$GITHUB_REPOSITORY --jq .visibility and exposes it as an output; the analysis job gates on needs.visibility.outputs.public == 'true'. The API is used instead of github.event.repository.visibility because that field is absent on schedule runs, whereas $GITHUB_REPOSITORY is always set. On a private fork the analysis job is skipped (green); on public it runs normally. Private repo with GitHub Advanced Security? Drop the gate.

README reconciliation

• The pre-existing "Enable CodeQL default setup" item conflicted with this advanced workflow (they're mutually exclusive) — reworded to keep default setup off.
• Scorecard's "delete if private" item — now it skips automatically, so deletion is only for opting out entirely.
• Non-Python forks change the matrix language (and build-mode for compiled stacks), not delete the file — CodeQL is multi-language.

Verification

• make lint green — actionlint (incl. shellcheck on the guard run:), zizmor, check-yaml, markdownlint all pass.
• Pinned action SHAs verified: 411c4c9a… dereferences to annotated tag v3.36.3; build-mode: none confirmed supported there.
• The private-stays-green semantics were adversarially verified: a skipped job reports Success (green), and a failing gh api degrades to public=false under the if-test idiom (no red).
• This PR's own pull_request run exercises codeql.yml end to end (public repo → analyze runs).

🤖 Generated with Claude Code

[JartanFTW]

Closing in favor of GitHub's default CodeQL setup, which is already enabled on this repo (state: configured, languages actions + python).

Why. For the template we want forks pointed at the best scanner with the least maintenance. Default setup is GitHub-tuned, auto-detects and auto-updates languages, and runs curated query suites. It also can't coexist with a committed advanced workflow — this PR's Analyze (python) failed at upload with "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled." The advanced workflow's only real edge — traveling to forks as a committed file — is already covered by the README checklist item recommending default setup. So a second-best, conflicting, maintenance-bearing workflow isn't worth it.

Net: no change to this repo's CodeQL (default setup stays on), and the README keeps recommending default setup for forks.

The one independently-useful piece from this branch — making scorecard.yml skip cleanly on a private fork instead of failing its upload — moves to its own PR: #69.