Harden release publishing and add CodeQL

[Codewriter90x]

What changed

• adds CodeQL analysis for Python and JavaScript/TypeScript using the extended security query suite
• keeps every third-party Action pinned to an immutable commit SHA
• splits release construction from publication
• runs build, validation and tests with read-only repository permissions
• downloads the validated bundle in a separate publish job
• verifies SHA-256 checksums before publishing
• creates GitHub artifact attestations for every release asset
• prevents checkout credentials from persisting in CodeQL and release jobs

Security boundary

Previously the release build and all repository scripts ran in a job with
contents: write. A compromised build step could therefore reach a writable
repository token. The build job now has only contents: read; the publish job
is the only job with write and attestation permissions and does not execute
dataset code.

Preserved behavior

Tags still have to match project.json, release assets are built and validated
with the existing pipeline, existing releases cannot be overwritten, and
prerelease status continues to come from project metadata.

Validation

• release v1.1.0 bundle built locally
• release bundle and SQL import validated
• 39 Python tests passed
• workflow YAML parsed successfully
• immutable Action SHAs verified against official tags
• git diff --check passed

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.