docs: add FORK.md explaining this fork and its related repositories

Nothing in the tree said this was a fork, why it exists, or how it relates to
the SakThai repos that sit alongside it. Add FORK.md recording the two
dev-only advisory bumps it carries (js-yaml GHSA-5p4m-2wfm-xmqj, tar
GHSA-r292-9mhp-454m), links to the sibling repos, and the point that matters
most: no workflow in those repos references this fork. They pin upstream
`github/codeql-action` by commit SHA, and repointing them here would defeat
the SHA-pinning Scorecard's Pinned-Dependencies check relies on.

The README gets a single blockquote line pointing at FORK.md, kept to one line
so syncing from upstream stays a trivial resolution. Everything else in
README.md is upstream's and is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DKk5SVtHLSPCwSDASJhfRL

Author: claude

FORK.md

@@ -0,0 +1,38 @@
+# Fork notes
+
+This is a fork of [`github/codeql-action`](https://github.com/github/codeql-action),
+maintained under [`beer-sakthai`](https://github.com/beer-sakthai) alongside the SakThai
+family repositories. Upstream's own documentation in [`README.md`](README.md) still
+applies in full — this file records only what is specific to the fork.
+
+## Why the fork exists
+
+To stage dependency-advisory remediation against the action's **own** dev-dependency
+tree, where a fix is available inside the existing semver ranges and touches only
+`package-lock.json`. So far:
+
+- `js-yaml` 4.3.0 → 4.3.1 and 3.15.0 → 3.15.1 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870)
+- `tar` 7.5.20 → 7.5.22 (GHSA-r292-9mhp-454m)
+
+Both are dev-only, so the bundled output under `lib/` is unchanged and needs no rebuild.
+
+## What the fork is *not*
+
+**No workflow in the SakThai repositories references this fork.** They pin **upstream**
+`github/codeql-action` by commit SHA:
+
+- [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) —
+  `codeql.yml`, `bandit.yml`, `ossar.yml`, `scorecard.yml`
+- [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) —
+  `codeql.yml`, `ossar.yml`
+
+Repointing any of them at this fork would defeat the SHA-pinning those repos rely on for
+Scorecard's Pinned-Dependencies check. Consume upstream; use this fork to prepare patches.
+
+## Related repositories
+
+| Repository | What it is |
+|---|---|
+| [`github/codeql-action`](https://github.com/github/codeql-action) | Upstream. The source of truth for everything in `README.md` and `CHANGELOG.md`. |
+| [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) | The Sak family agent runtime — `sakthai` package, six personas, memory, MCP, web API. |
+| [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) | The SFT + GRPO training and evaluation pipeline behind the family's models. |

README.md

@@ -1,5 +1,7 @@
 # CodeQL Action
 
+> **Fork of [`github/codeql-action`](https://github.com/github/codeql-action).** See [`FORK.md`](FORK.md) for what differs and for the related SakThai repositories. Everything below is upstream documentation and applies unchanged.
+
 This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
 
 For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).