[devin-ai-integration]

Summary

Adds .github/workflows/codeql.yml, modeled on invisible-tools/dawn's current CodeQL workflow. It runs on push to main plus a Monday 06:00 UTC cron only. There is deliberately no pull_request trigger, so PR checks are unchanged.

• analyze: matrix over go (autobuild, with setup-go from go.mod), actions, default query suite, paths-ignore: **/*_test.go, conformance/**, examples/**. Public repo, so it uses ubuntu-latest, which is already 4-core / 16 GB on public repos.
• relay-alerts (push only): collects open High/Critical alerts created by this run on this commit, then POSTs each one to SLACK_CODEQL_WEBHOOK_URL and to the Devin triage webhook (DEVIN_CODEQL_WEBHOOK_URL + DEVIN_CODEQL_WEBHOOK_SECRET). This job is the same as dawn's, including the delivery fix in https://github.com/invisible-tools/dawn/pull/9021: it runs even if one language's scan fails (!cancelled() instead of the default success() gate), and the Devin webhook step still runs if the Slack post fails.
• Actions pinned to SHAs: checkout v7.0.1, codeql-action v4.38.3.

Before merge: the three secrets must be visible to this repo (org-level secret with selected-repo access, or repo secrets). Without them the relay fails only when there is an alert to post.

Licensing: public repo. A probe run completed cleanly (analyze + relay green).

Link to Devin session: https://app.devin.ai/sessions/d405aab680584212bcc75f9bf5c329e0
Open in Devin Desktop: https://app.devin.ai/desktop/session/d405aab680584212bcc75f9bf5c329e0?variant=devin
Requested by: @kakarot0O

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[kakarot0O]

Re-approving per Leif's suggestion