chore: branch-protection JSON + apply workflow + artifact cleanup + CodeQL #14

Problem

Branch protection enforced by hand drifts. Artifact storage on a public repo grows without bound. SAST (CodeQL) is the cheapest static security signal.

Proposed solution

Port .github/branch-protection/{main,develop}.json (declarative protection: required status checks, no force-push, no deletions, conversation_resolution, 1 approving review). Port .github/workflows/branch-protection.yml (weekly + workflow_dispatch + on edits to JSON; applies via gh api). Port .github/workflows/artifact-cleanup.yml (weekly, prunes >7 days). Port .github/workflows/codeql.yml (Python + JS/TS, scheduled).

Acceptance criteria

• Branch-protection workflow applies main + develop protection on workflow_dispatch.
• Required-checks list matches actual ci.yml job names (verified by chore: CI meta-gates (branch-protection contexts sync, commit-types sync) #10's contexts-sync gate).
• Artifact cleanup runs weekly and on dispatch.
• CodeQL workflow is present, scheduled, and queues on PRs.

Priority rationale

High: portfolio repos get scanned by recruiters and other engineers. Solid branch protection + SAST signal trust.

Depends on

#9, #10