chore(sync): synced file(s) with cplieger/ci

.github/workflows/codeql.yml

@@ -1,3 +1,10 @@
+# Synced from cplieger/ci/.github/workflow-templates/codeql.yml — DO NOT EDIT.
+# CodeQL static analysis. Uploads SARIF to the repo's Security tab and backs the
+# code-scanning branch-protection gate.
+#
+# This template predates the sync-header convention (2026-06-02) and was one of
+# two that never got one backfilled, so nothing warned an editor that the next
+# chore(sync) would clobber a local change. Edit it HERE.
 name: CodeQL
 
 on:

.github/workflows/coverage.yml

@@ -26,5 +26,10 @@ jobs:
       contents: write
     # NOTE: pin this @SHA to the ci release tag that first contains
     # coverage.yaml when cutting that tag (see ci.md "Updating and propagating").
-    # Renovate then tracks the `# v2` comment and bumps the digest thereafter.
+    # Thereafter repo-sync is the SINGLE WRITER of this digest in every consumer:
+    # each ci release propagates as an auto-merging chore(sync) PR with the new
+    # digest already baked in. Renovate does NOT bump it there — cplieger/.github's
+    # preset disables the github-actions manager on all six synced workflow
+    # filenames, so sync cannot be raced. Only in cplieger/ci itself (and two other
+    # named exclusions) does Renovate track this pin.
     uses: cplieger/ci/.github/workflows/coverage.yaml@5ba93f366541ece117eaed5d1490e0d4c4bc5fd0 # v2

.github/workflows/security.yml

@@ -1,3 +1,9 @@
+# Synced from cplieger/ci/.github/workflow-templates/security.yml — DO NOT EDIT.
+# Dependency and vulnerability review on Go dependency changes.
+#
+# This template predates the sync-header convention (2026-06-02) and was one of
+# two that never got one backfilled, so nothing warned an editor that the next
+# chore(sync) would clobber a local change. Edit it HERE.
 name: Security
 
 on: