ci(codeql): newer codeql-action SHAs reject empty JS/TS — Rust-primary repo needs build-mode adjustment or leg-drop

[hyperpolymath]

Context

PR #68 (maintenance sweep) bumped `github/codeql-action/{init,analyze,upload-sarif}` from `c6f9311` to `2a1689e` (current HEAD).

The newer action version rejects `build-mode: none` runs that find zero JS/TS files:

```
[2026-06-01 18:47:55] [build-stderr] Only found JavaScript or TypeScript files that were empty or contained syntax errors.
##[error] CodeQL could not process any code written in JavaScript/TypeScript.
Exit code was 32.
```

valence-shell is Rust-primary; the JS/TS analyze leg in `.github/workflows/codeql.yml` was either a template artifact or a no-op existence check. The older action treated this as benign; the newer one fails the job hard.

Resolution

PR #68 reverted just the three CodeQL SHAs back to `c6f9311` to unblock the maintenance merge; the other 6 action SHA bumps (checkout / cache / upload-artifact / rust-cache / scorecard-action) remained at HEAD.

Options for permanent fix

1. Drop the JS/TS leg — most defensible since the repo has no JS/TS source. Remove the matrix `include` block in `codeql.yml`. CodeQL would then be a no-op (or removed entirely; `Hypatia Neurosymbolic Analysis` covers semantic analysis already).
2. Add `autobuild` or a `with: skip-queries: false, expect-error: true` — keep the leg as a smoke test but accept the empty-source case.
3. Add a Rust language to the matrix — only viable when CodeQL Rust support stabilises (currently community-preview).

Option 1 is cleanest given the estate's preference for `Hypatia` as the canonical analysis layer.

Acceptance criteria

• CodeQL action SHAs back at HEAD (or workflow removed)
• `analyze` job green on `main`
• If `codeql.yml` is removed, `scorecard-enforcer.yml` reference to `codeql-action/upload-sarif` reviewed (currently still uses the old SHA via the fixup)

Refs: PR #68.

🤖 Filed by maintenance sweep 2026-06-01