ci: remove CodeQL control-plane workflow

[haasonsaas]

Summary

• delete the scheduled codeql-guard workflow from the org-control-plane repo
• replace CodeQL quota guidance with a blanket-static-analysis budget policy that says not to add CodeQL or GitHub default code scanning
• keep the prohibition cheap by folding a local workflow-action check into codex-rails-check
• update SECURITY.md and the profile index so CodeQL is treated as absent, not something to scope

Live evidence

• EvalOps default security configuration for new repos is EvalOps Blacksmith recommended (id=245233) with code_scanning_default_setup: disabled, enforcement: enforced, default_for_new_repos: all
• evalops_config_repo_count=87 and repo_count=87, so every current repo is attached to the CodeQL-disabled config
• live code search for "uses: github/codeql-action" org:evalops returned no results
• live code search for github/codeql-action org:evalops path:.github/workflows returned no results

Test Plan

• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' .github/workflows/*.yml .github/workflow-templates/*.yml\n- actionlint -shellcheck= -pyflakes= .github/workflows/*.yml .github/workflow-templates/*.yml\n- ruby .github/scripts/audit-engineering-practices.rb --contract-only --json-output /tmp/engineering-practices-contract.json --markdown-output /tmp/engineering-practices-contract.md\n- ruby -Itest test/audit_engineering_practices_test.rb\n- ruby -Itest test/workflow_pr_ref_guard_test.rb test/verify_org_control_plane_contract_test.rb\n- bash -lc 'set -euo pipefail; shopt -s nullglob; files=(.github/workflows/*.yml .github/workflows/*.yaml .github/workflow-templates/*.yml .github/workflow-templates/*.yaml); blocked_owner="github"; blocked_prefix="code"; blocked_suffix="ql-action"; blocked="${blocked_owner}/${blocked_prefix}${blocked_suffix}"; if grep -RInE "^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]*${blocked}([/@[:space:]]|$)" "${files[@]}"; then exit 1; fi; echo ok'\n- ruby -Itest -e 'Dir["test/*_test.rb"].sort.each { |f| require "./#{f}" }'