improvement(ci): move CodeQL off default setup onto Blacksmith (#6219)

* improvement(ci): move CodeQL off default setup onto Blacksmith

Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no
cancel-in-progress: PR scans ran 30-125 min and re-ran on every push (#6183
burned six overlapping runs). None of that is reachable from the settings UI,
so the config moves into the repo.

- Blacksmith 8-vCPU via the same CI_PROVIDER escape hatch as ci.yml
- cancel-in-progress scoped to pull_request so push/schedule scans finish
- push to main + PR to main/staging + nightly safety net
- paths filter so doc-only PRs skip the run entirely
- paths-ignore config drops tests/mocks/fixtures: 12,716 -> 11,128 files
- languages: javascript-typescript + actions; python dropped (7 files in tree)

Default setup has been disabled; the two cannot both be active.

* fix(ci): restore CodeQL coverage of the data-drain test route

Review round 1.

- Drop the '**/test/**' and '**/tests/**' globs. A `test` directory is a
  routable Next.js path segment, and those globs excluded
  apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts —
  a POST handler that authorizes, decrypts destination credentials and makes
  an outbound request. CodeQL paths-ignore has no `!` negation to carve it
  back out, and the globs only covered 76 of 12,716 files.
- Add `ready_for_review` to the pull_request activity types. It is not a
  default type, so a PR opened as a draft and later marked ready was skipped
  by the draft guard and never rescanned until the next push.

.github/codeql/codeql-config.yml

@@ -0,0 +1,33 @@
+name: Sim CodeQL config
+
+# Trims the extraction surface. CodeQL parses every matching file into a
+# database before a single query runs, and that phase dominates runtime on a
+# ~12.7k-file JS/TS tree. Test and fixture code is not attacker-reachable, so
+# excluding it costs no real coverage.
+#
+# paths-ignore applies to analysis. The workflow's `on.pull_request.paths`
+# filter is separate and decides whether the run happens at all.
+paths-ignore:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'
+  - '**/*.test.js'
+  - '**/*.spec.ts'
+  - '**/*.spec.tsx'
+  - '**/__tests__/**'
+  - '**/__mocks__/**'
+  - '**/__fixtures__/**'
+  - '**/e2e/**'
+  # Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a
+  # routable Next.js path segment, not necessarily test code: those globs
+  # excluded the real endpoint
+  # apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,
+  # which authorizes, decrypts destination credentials, and makes an outbound
+  # request. CodeQL's paths-ignore has no `!` negation to carve it back out
+  # ("The filter pattern characters ?, +, [, ], and ! are not supported and will
+  # be matched literally"), and the globs only covered 76 of 12,716 files, so
+  # the naming convention above is the safer filter.
+  - '**/*.d.ts'
+  - '**/node_modules/**'
+  - '**/dist/**'
+  - '**/.next/**'
+  - 'apps/docs/content/**'