Add a CodeQL scan for TypeScript #558

Summary

Static analysis.

Context

Before mainnet the project needs repeatable releases, nightly integration runs, observability for deployed contracts and clear operational documentation.

This issue belongs to Stage 11: Operations, Observability and Release Engineering.

Objective

Deliver the change described above so that: scan runs weekly.

Requirements

• Enable CodeQL for sdk/
• Triage findings

Out of Scope

Feature work on contracts or SDK APIs.

Acceptance Criteria

• Scan runs weekly
• CI is green and a maintainer has reviewed the change

Definition of Done

• The workflow runs green on a pull request and uses pinned action versions
• Findings, assumptions and residual risks are written down in docs/
• The pull request links this issue and updates CHANGELOG.md when behavior changes

References

• .github/workflows/
• Phase 1 internal review
• Security notes