ci: drop redundant CodeQL scan, fix Scorecard ARM64 incompatibility #1398

Summary

Two changes to align CI with our ARM64-only runner policy and remove a redundant security scanner: drop codeql.yml (duplicate coverage, incompatible with ARM64), and replace the docker-based step in scorecard.yml with a native ARM64 binary (currently failing every run).

Motivation

Triggered by a CI audit (config review + 100-run history analysis + upstream verification). Two issues found:

1. codeql.yml runs on ubuntu-24.04 (x86_64), the only workflow in the repo not on our -arm fleet. This isn't a bug to fix by switching runners — codeql-action does not support Linux ARM64 today (confirmed via upstream: open, unmerged github/codeql-action#4072 "Add support for Linux Arm64 runners", and open issue github/codeql-action#2700 "Linux ARM: exec format error"; the official codeql-cli-binaries releases ship only codeql-linux64.zip, no arm64 asset). The job only scans the actions language (workflow YAML, not our Rust source). Comparing the CodeQL actions query pack against the zizmor audits already running in ci.yml (min-severity: high) shows every CodeQL rule maps to an existing zizmor audit already covering this repo on ARM64:

   CodeQL actions query (CWE)	Zizmor audit (already running)
   CodeInjection / EnvVarInjection (077, 094)	template-injection, insecure-commands
   UseOfKnownVulnerableAction (1395)	known-vulnerable-actions
   MissingActionsPermissions (275)	excessive-permissions, undocumented-permissions
   ExcessiveSecretsExposure / SecretsInArtifacts (312)	secrets-outside-env, unredacted-secrets, secrets-inherit
   CachePoisoning x3 (349)	cache-poisoning
   UnpinnedActionsTag / ArtifactPoisoning (829)	unpinned-uses, stale-action-refs, impostor-commit, artipacked

   The one real gap: zizmor is set to min-severity: high, which suppresses medium-severity findings that CodeQL doesn't filter.

2. scorecard.yml has failed every scheduled run since at least 2026-07-20 (5/5 most recent runs checked, weekly cadence) with exec /scorecard-action: exec format error. Confirmed root cause: ghcr.io/ossf/scorecard-action:v2.4.4 publishes an amd64-only image (docker manifest inspect reports "architecture": "amd64", single-platform manifest, not a manifest list) run on ubuntu-24.04-arm. Upstream has an open, unresolved issue for this: ossf/scorecard-action#1697 "Provide ARM64 docker image" (latest release v2.4.4, 2026-07-23, no fix). No maintained third-party action fills this gap (checked GitHub repo search and web search; all forks found are stale, 0-star, no ARM fix).

   Two things confirmed this is safe to fix without losing anything today:

   • api.scorecard.dev/projects/github.com/clouatre-labs/aptu-coder returns 404 — there is no published Scorecard score currently, consistent with every run failing for the past month. publish_results: true has not been producing a result to publish.
   • Our OpenSSF Best Practices "silver" badge (bestpractices.dev project 12275, badge_level: silver) is a separate, self-attested program with no dependency on this workflow or publish_results.

Removal Safety (CodeQL)

Verified this won't be silently re-enforced after removal:

• Required checks on both the classic branch protection API and the "Protect main branch" ruleset list only CI Result — CodeQL is not required on either.
• Org clouatre-labs has a "GitHub recommended" code-scanning-default-setup config, but it's attached to zero repos and isn't the org default (code-security/configurations/17/repositories empty; .../configurations/defaults returns []).
• This repo's code-scanning/default-setup reports not-configured and only activates via explicit action, not automatically.
• Zero open CodeQL alerts exist in the Security tab — nothing left dangling.

Proposed Changes

1. Remove codeql.yml

• Delete .github/workflows/codeql.yml.
• In .github/workflows/ci.yml, change the zizmor step's min-severity from high to medium to retain equivalent severity coverage.

2. Replace the scorecard-action docker step with a native ARM64 binary

Same pattern already used for commitlint (native tool install, no docker container) and cargo-semver-checks (checksum-verified binary download) in ci.yml:

• Download scorecard_<version>_linux_arm64.tar.gz from the ossf/scorecard releases (not scorecard-action — the core CLI ships a real linux/arm64 build; verify against the release's scorecard_checksums.txt).
• Run ENABLE_SARIF=1 scorecard --repo=github.com/clouatre-labs/aptu-coder --format=sarif --show-details > results.sarif (confirmed: options/options.go gates SARIF output behind the ENABLE_SARIF env var — this is exactly what scorecard-action's Dockerfile sets internally before invoking the same binary).
• Upload via the existing github/codeql-action/upload-sarif action (confirmed arch-agnostic: runs: using: node24, no docker).
• Drop publish_results: true — no CLI equivalent exists (it's implemented as an OIDC-signed call inside scorecard-action itself, not exposed as a CLI flag), and there is currently no published score to preserve (see Motivation).

Constraints

• No change to required status checks; CI Result remains the sole required check.
• zizmor and the replacement scorecard step must stay on ubuntu-24.04-arm, consistent with the rest of the fleet.
• Scorecard binary download must be checksum-verified before execution, matching the existing cargo-semver-checks pattern.
• If a public OSSF Scorecard badge/API listing is wanted later, that requires either an ubuntu-24.04 exception for publish_results or waiting on Provide ARM64 docker image ossf/scorecard-action#1697 — out of scope here.

Acceptance Criteria

• .github/workflows/codeql.yml removed
• zizmor step in ci.yml set to min-severity: medium
• scorecard.yml no longer uses ossf/scorecard-action; runs the checksum-verified linux_arm64 CLI binary on ubuntu-24.04-arm
• SARIF output uploaded via github/codeql-action/upload-sarif, visible in the Security tab
• scorecard.yml run succeeds (no exec format error)
• No .github/workflows/** references to codeql-action/init or codeql-action/analyze remain