refactor(risk): centralize run_payload escalation; guard classify==spec invariant #1343

	name: CodeQL

	# Scans pull requests, plus a weekly scheduled run for main-branch drift.
	# The post-merge push:main run was redundant with the PR scan (squash PRs
	# merge the exact diff already analysed) and the weekly schedule, so it
	# was dropped.
	on:
	pull_request:
	branches: [main]
	paths-ignore:
	- '**.md'
	- 'docs/**'
	- 'LICENSE'
	- '.github/assets/**'
	schedule:
	- cron: '0 6 * * 1'

	concurrency:
	group: codeql-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	actions: read
	contents: read
	security-events: write

	# Actions pinned to Node 24-native major versions; no env override needed.

	jobs:
	analyze:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	language: [go]

	steps:
	- uses: actions/checkout@v5

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.11'
	cache: true

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: ${{ matrix.language }}

	- name: Autobuild
	uses: github/codeql-action/autobuild@v4

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v4
	with:
	category: "/language:${{ matrix.language }}"

Provide feedback