Extend CodeQL to the actions language and settle the query suite #341

Problem statement

Follow-up to #298 and the workflow merged in #335.

#298 asked for SAST covering "the website (JS/TS) and workflow/config surfaces". The workflow that landed in #335 covers the first half only: a matrix entry for javascript-typescript, which extracts 274 files from website/** and scripts/ and reports 0 findings against 87 rules.

The workflow half was assumed to need a different tool. It does not: CodeQL ships an actions language with its own extractor and security queries (github/codeql/actions/ql/src/Security), covering CWE-094 (code injection in workflows), CWE-829 (unpinned or third-party actions), CWE-312 (cleartext credentials), plus CWE-275, CWE-285 and CWE-349.

Nothing in this repo analyses .github/workflows/, which is the highest-privilege code here: deploy.yml holds pages: write and id-token: write.

Separately, the query suite was never chosen, only defaulted. The baseline is 87 rules and 0 results, which is a clean starting point but says nothing about what security-extended would surface.

Proposed solution

1. Add - language: actions with build-mode: none to the matrix in .github/workflows/codeql.yml, run it, and confirm whether this repo's workflows analyse cleanly without extra configuration.
2. Run security-extended on a throwaway branch and compare the alert count with the default suite. Decide, and record the numbers in this issue.
3. Add the dismissal policy to TRIAGE.md: who may dismiss a code scanning alert, and which reason codes are acceptable.

If the actions queries turn out to be thin, the fallback is actionlint in CI for syntax and shellcheck, and zizmor for workflow security rules. Do not add a second scanner before testing the one already being installed.

Scope and impact

One matrix line plus a comparison run. The risk is noise: if security-extended or the actions queries produce a wall of findings, the gate gets ignored, so the baseline has to be triaged before either change lands as a default.

Acceptance criteria:

• actions analysis runs and its findings are triaged
• Query suite chosen, with the comparison numbers recorded here
• TRIAGE.md states the dismissal policy for code scanning alerts