ci: add CodeQL, pre-commit, and labeler workflows

- CodeQL: Python security analysis on push/PR + weekly schedule
- Pre-commit: ruff lint/format checks on push/PR
- Labeler: auto-label PRs based on changed files

.github/workflows/pre-commit.yml

@@ -0,0 +1,26 @@
+name: Pre-commit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - uses: pre-commit/action@v3.0.1