Add daily CodeQL security scanning workflow

[Copilot]

Adds CodeQL security analysis running on a daily schedule rather than on every push to reduce CI overhead.

Changes

• Created .github/workflows/codeql.yml with daily cron schedule (6:00 AM UTC)
• Scans Go and JavaScript using matrix strategy with security-and-quality queries
• Includes workflow_dispatch for manual runs
• CI workflow (.github/workflows/ci.yml) remains unchanged for fast push/PR feedback

Configuration

on:
  schedule:
    - cron: '0 6 * * *'
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  security-events: write

The workflow builds Go code before analysis and runs both languages in parallel via matrix strategy.

Original prompt

Change the codeql action to run daily for actions check instead of on every push (you may need to split the action in two files)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull Request Overview

This PR introduces CodeQL security analysis and refactors the changeset workflow lock file timestamp checking. The changes include adding a new scheduled security scanning workflow and migrating shell-based file timestamp validation to JavaScript for improved error handling.

• Added CodeQL workflow for automated security scanning of Go and JavaScript code
• Refactored timestamp checking in changeset workflow from shell script to JavaScript implementation

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/codeql.yml	New workflow for daily CodeQL security analysis of Go and JavaScript code
.github/workflows/changeset.lock.yml	Replaced shell-based timestamp checking with JavaScript implementation using actions/github-script for better error handling and logging

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.