[P1] Enable CodeQL default setup for public source

[semantic-craft]

Problem

This public source repository has GitHub native secret scanning, push protection, dependency alerts, and protected-default-branch controls, but CodeQL code scanning is not configured. The repository contains JavaScript, which is supported by the current CodeQL release.

Scope

Enable GitHub's managed Default setup only. Use GitHub-hosted standard runners; do not configure self-hosted or larger runners, do not add secrets, and do not change repository visibility, source history, or release workflows.

Acceptance criteria

• Enable CodeQL Default setup for the repository's supported source language(s) and GitHub Actions when detected.
• Keep the recommended default query suite unless a concrete finding requires a narrower change.
• Confirm the initial generated analysis actually runs on GitHub-hosted infrastructure and reaches a terminal success state.
• Review initial alerts; do not suppress a real failure or publish sensitive details.
• Confirm the CodeQL tool status page reports the setup is working as expected.
• Record the successful run and close this issue.

Safety boundary

A zero-step billing/runner failure is not a passing scan. Do not add private credentials or access private repositories from code scanning.