016 US6: the deepest corpus, and a ceiling that is actually a ceiling

[jlgore]

Completes US6 of 016-native-tools — the CodeQL adapter — and fixes two refusals that were being spelled as the wrong kind of refusal.

What lands

The CodeQL adapter (3e773bc). A bundle-pinned external scanner: probe answers everything a scan can be refused for without spawning anything, preflight verifies the CLI's own version --format=json against the operator's pin in-scope, and steps authors database create then database analyze. Traced languages are declined explicitly via a new UnavailableReason::LanguageRequiresBuild carrying what is analysable — extraction for compiled languages intercepts the build's process spawns, which would mean admitting every compiler and linker the build invokes.

An unpinned bundle is now Unavailable, not Failed (e5b3397). It was reaching steps, so it read as "ran and broke" when nothing had run. probe owns it now, returning BundleMismatch { expected: UNPINNED, found: None } — a spelling no version comparison can be mistaken for — with its own Display arm naming the setting that would fix it.

The scan budget bounds the scan, not each child of it. A CodeQL scan is a version check plus two children, each of which was handed the full budget afresh: a 30s ceiling bounded a 90s scan while every individual child looked well-behaved. The budget becomes a deadline at the top of the call and each child gets what is left of it.

Verification

• cargo test --features sec — all green, 0 failures
• cargo clippy --workspace --all-targets --features sec — clean
• cargo fmt --check — clean
• tests/codeql_adapter.rs::the_budget_bounds_the_whole_scan_not_each_child_of_it proves the deadline: three 2s children under a 3s ceiling must fail, and must fail in under 5s
• Every refusal case asserts not just the outcome but that the stub CLI logged no invocation

Not in this PR

T073 — walking a provisioned bundle end to end and recording it in quickstart.md. Worth noting the evidence is now in hand: a local codeql-bundle reports CLI 2.26.1 (matching the pin), and its rust/tools/ ships no tracing-config.lua, which is CodeQL's own tracedness test. So rust is buildless and belongs in BUILDLESS_LANGUAGES — that one-line change plus the walkthrough is what T073 still owes.

🤖 Generated with Claude Code