chore(template): clean-slate template snapshot from bb4a0c7

Curated, product-agnostic snapshot of the post-story-04 tree: demo
content deleted, auth-only reference feature, web-next shell, all gates
green. Product-specific docs, ADRs 027-029, PRDs/epics/archive, editor
library traces, and product naming are curated out; generic template
repairs (coverage provider devDeps, root test:coverage script, live
lint fixes, root-only release-please) are kept. See TEMPLATE.md for
provenance, curation list, and usage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+# CodeQL static analysis — javascript-typescript.
+#
+# Runs on every push to main, every pull request, and weekly on Wednesday
+# at 02:00 UTC (staggered from the trace-revalidation cron on Monday 06:30).
+#
+# NOTE (consumers): CodeQL is free for public repositories and GitHub Free
+# plans. For *private* repositories it requires GitHub Advanced Security
+# (available on GitHub Enterprise Cloud/Server or as an add-on). If you are
+# using this template with a private repo and do not have Advanced Security
+# enabled, remove or disable this workflow — it will fail at the "Initialize
+# CodeQL" step with a licensing error.
+
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # 02:00 UTC every Wednesday
+    - cron: "0 2 * * 3"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          # Uses the default query suite (security-and-quality). To restrict
+          # to security-only queries, set:
+          #   queries: security-extended
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3