ci(codeql): cron weekly→monthly (cut 3, standards#288)

[hyperpolymath]

Per standards#286 canonical (cut 3, Option B 2026-05-30): convert CodeQL scheduled run from weekly 0 6 * * 1 to monthly 0 6 1 * *. PR-trigger runs unchanged — every PR still gets CodeQL.

Refs hyperpolymath/standards#288 (campaign).

Summary

Changes

RSR Quality Checklist

Required

• Tests pass (just test or equivalent)
• Code is formatted (just fmt or equivalent)
• Linter is clean (no new warnings or errors)
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/STATE.a2ml updated (if project state changed)
• .machine_readable/ECOSYSTEM.a2ml updated (if integrations changed)
• .machine_readable/META.a2ml updated (if architectural decisions changed)
• Documentation updated for user-facing changes
• TOPOLOGY.md updated (if architecture changed)
• CHANGELOG or release notes updated
• New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0)
• ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

[github-actions]

🔍 Hypatia Security Scan

Findings: 3 issues detected

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	2

View findings

[
  {
    "reason": "Repository has 4 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): SASTID -- SAST -- 6 day(s) old",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 6 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence