ci: add CodeQL, lint/typecheck/smoke CI, and dependency review

- ci.yml: ruff check + format check, pyright typecheck, and import/CLI
  smoke test on Python 3.10/3.11/3.12/3.13 matrix. Uses uv like the
  existing pre-commit workflow for consistency.
- codeql.yml: weekly + push/PR Python security-and-quality analysis.
- dependency-review.yml: fail PRs adding high+ severity CVEs or copyleft
  licenses that would taint GPL-3.0 (AGPL, SSPL, BUSL).

.github/workflows/codeql.yml

@@ -0,0 +1,49 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Sync dependencies
+        run: uv sync --all-extras --dev
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"