feat(ci): CodeQL advanced setup that skips plots/**

[MarkusNeusinger]

Summary

• CodeQL runs here as GitHub's default setup, which cannot exclude paths: every push to an implementation/* branch and every impl-* PR triggered a full five-language scan. During the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs waited in the runner queue at once, ahead of the pipeline's own jobs.
• .github/workflows/codeql.yml is the advanced-setup equivalent: same languages (actions, javascript-typescript, python), weekly cron, push/pull_request on main with paths-ignore: plots/**, and the same exclusion inside the analysis config so a docs-only push does not scan thousands of generated plot files. Actions are SHA-pinned (codeql-action v4.37.9).
• Follow-up in repository settings (not a code change): default setup must be disabled (Code security → Code scanning) after this merges; GitHub rejects advanced-setup uploads while default setup is on. I will do that right after the merge and confirm the first workflow run.

Plan

N/A

Test plan

• The PR itself triggers the new workflow (it changes files outside plots/**); the three Analyze (...) jobs may report an upload conflict until default setup is switched off — expected.
• After the settings change: a push to main outside plots/** runs all three analyses green; the next impl-* PR starts no CodeQL run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SrKzcwZBnref1sWYtdXynu

[Copilot]

🟡 Changes recommended

The changelog update introduces a duplicate ### Changed section under [Unreleased], which should be consolidated to keep the changelog structure consistent.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Switches CodeQL from GitHub’s default setup to an advanced CodeQL workflow so the repository can exclude generated plot implementations under plots/**, reducing runner queue pressure caused by impl-* pipeline activity.

Changes:

• Add an advanced CodeQL workflow (.github/workflows/codeql.yml) that excludes plots/** in both triggers and analysis config.
• Document the new workflow in docs/workflows/overview.md.
• Add a changelog entry describing the CodeQL setup change.

File summaries

File	Description
docs/workflows/overview.md	Adds codeql.yml to the workflow overview table with its purpose and exclusions.
CHANGELOG.md	Records the CodeQL advanced-setup switch under [Unreleased].
.github/workflows/codeql.yml	Introduces the advanced CodeQL workflow with plots/** excluded from triggers and analysis.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The workflow, docs, and changelog changes are consistent with the PR’s stated goal and correctly exclude plots/** at both trigger and analysis levels.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The workflow, documentation, and changelog updates are consistent with the PR description and correctly exclude plots/** from both triggers and analysis.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The workflow and documentation changes are consistent with existing repo workflow conventions (SHA pinning, concurrency patterns) and correctly exclude plots/** at both trigger and analysis levels.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite