WIP: CodeQL integration — Phase 1 subphases + harness cleanup + CodeQL install scaffold

.github/workflows/tests.yml

@@ -46,6 +46,18 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements.txt
 
+      - name: Run make init (full CodeQL install)
+        if: matrix.python-version == '3.14'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: make init
+
+      - name: Run make init (skip CodeQL install)
+        if: matrix.python-version != '3.14'
+        env:
+          CODEQL_SKIP_INSTALL: 1
+        run: make init
+
       - name: Run pytest with coverage
         id: pytest
         run: |

.gitignore

@@ -220,6 +220,13 @@ __marimo__/
 tmp/*
 !tmp/.gitkeep
 
+# CodeQL managed install and cache
+.tools/
+.cache/codeql/
+
+# CodeQL runtime artifacts
+itemdb/codeql/*
+
 # CodeCome runtime artifacts
 itemdb/index.md