docs: mark A7 gatekeeping as complete #87

[four-bytes-robby]

Summary

Mark A7 (Gatekeeping & Review Automation) as complete in ROADMAP.md.

Note: Branch protection config needs adjustment

The push rejection revealed that the required status check is named "completed" but the CI job is named Build & Test. In Settings → Branches → main → Edit:

• Remove: completed (doesn't exist)
• Add: Build & Test (the actual CI job name from ci.yml)

Without this fix, no PR can merge because the required check can never pass.

Closes #87

---

Summary by cubic

Checks off all A7 (Gatekeeping & Review Automation) acceptance criteria in ROADMAP.md and sets A7 status to Done, linked to #87. Adds a CodeQL security analysis workflow for JS/TS on PRs and pushes to main.

• Migration
  • In Settings → Branches → main → Edit:
    • Remove completed from Required status checks.
    • Add Build & Test (the CI job name).

^{Written for commit d989296. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.