feat: E2E deployment gate with floors, fixtures, SHA pins

[zhongliang02-bot]

Test infrastructure only — codeql-config.yml is unchanged, so nothing consumers scan changes on merge. Closes Codex NO-GO findings #1, #7, #10.

What it adds

• gate/ — derives the scan matrix from the config's own packs: keys, then asserts against this run's SARIF (no baseline filtering): query-count floor (catches query-filters over-excluding) and expected custom rule IDs loaded (catches a pack that installs but skips its queries, or a CLI bump that drops one).
• No fixtures here. Whether a query is any good is a question about the query — already tested by codeql-pack's unit tests and fixtures. This repo owns the config, so it asserts only that coverage is live.
• Floors live in gate/config.json — bumping one is a reviewed diff, not a magic number.
• ci.yml rewired to run those assertions; all uses: SHA-pinned (also in sample-workflow.yml).
• Tag v1.0.0 created at a4c7e5d — the rollback point.

Evidence

• Green: https://github.com/opengovsg/codeql-config/actions/runs/34583233219 — 92 queries ≥ floor 87, all 7 custom rule IDs loaded.
• Red: https://github.com/opengovsg/codeql-config/actions/runs/34583384735 — dropped 2 custom packs; floor still passed (88 ≥ 87) but their 4 rule IDs vanished → red. Catches the "installs-but-skips" case that a count floor alone misses.

Before you merge

• ⚠️ Temporarily drops the built-in Actions lane from this repo's CI until PR feat: add actions-custom-queries@1.1.2 to central config #19 adds the actions: packs key (strict-derive, per operator decision). In that window the daily codeql-action-testing canary is the only Actions watch. Merge feat: E2E deployment gate with floors, fixtures, SHA pins #20, then feat: add actions-custom-queries@1.1.2 to central config #19.
• ⚠️ Merging makes the gate run, not block. Add Deployment gate as a required status check on the prod ruleset (2894624) — separate click.
• Actions floor is 16, not 17 (config's query-filters exclude actions/missing-workflow-permissions); post-feat: add actions-custom-queries@1.1.2 to central config #19 it becomes 19 (16 + 3 custom), not 20. Don't "fix" it back.