Promote staging -> main (reusable CodeQL runtime)

[0xPlayerOne]

Adds the centrally hosted CodeQL workflow runtime while retaining the current local CodeQL wrapper during the release transition.

CodeQL remains separate from CI and Security, preserves native GitHub permissions, and keeps private-repository code-security detection.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• .github/workflows/reusable-codeql.yml

---

_{Reviewed by step-3.7-flash · Input: 66.1K · Output: 3.5K · Cached: 134.3K}