ci(codeql): remove the duplicate CodeQL workflow, keep the GitHub default setup

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- CodeQL runs through the GitHub default setup only; the own workflow `.github/workflows/codeql.yml` is removed (T-20261107-558181168) on 2026-11-07:
+  - The repository has the GitHub default setup for code scanning (python and actions, weekly, default query suite, configured since 2026-07-22). The workflow from 2026-10-30 was a second, "advanced" configuration, and its `analyze` job failed on every run (push, pull request, schedule) with "advanced configurations cannot be processed when the default setup is enabled". The default setup already covers Python and GitHub Actions; no coverage is lost.
+  - `tests/test_metadata.py`: the contract test that required the workflow now forbids it and any `github/codeql-action` step. To switch to an advanced setup later, change the repository setting first and add the workflow in the same step.
+
 - Automation control no longer hides unreadable `automation.toml` files and writes them atomically (T-20261101-844031160) on 2026-11-07:
   - Unreadable definitions are reported, not skipped: `scan_automations()` returns them next to the readable records (`UnparseableAutomation`: folder name, path, error text), `find_automation_anomalies()` has a new `unparseable` category, and `diagnose()` lists them in the report (`unparseable_automations`, shown by `to_text()`) without a new issue code, so the public health exchange contract v1 stays unchanged. `load_automations()` keeps its signature and still returns only the readable records. This matters for the duplicate `model`/`reasoning_effort` keys of 2026-10-31, which tomlkit rejects as `ParseError`: 94 of 113 files would have been invisible to pause, restore and the anomaly check.
   - Pause, restore and activate-all list every unreadable definition (folder, path, error) in `errors` and in the new `unparseable_ids`, so `status` is never `ok` and the tray and the orchestrator show it as partial or failed. IDs that CareCenter paused earlier stay remembered while their file is unreadable; an unreadable file CareCenter never paused is not adopted, so a later restore cannot activate something the user paused.

tests/test_metadata.py

@@ -844,15 +844,16 @@ def test_dependabot_actions_and_pip_guard() -> None:
     assert "open-pull-requests-limit: 3" in content
 
 
-def test_codeql_concurrency_guardrail() -> None:
-    """Verify .github/workflows/codeql.yml defines concurrency and least-privilege permissions."""
-    codeql_path = ROOT / ".github" / "workflows" / "codeql.yml"
-    assert codeql_path.is_file(), "codeql.yml must exist"
-    content = codeql_path.read_text(encoding="utf-8")
-    assert "concurrency:" in content
-    assert "cancel-in-progress: true" in content
-    assert "security-events: write" in content
-    assert "languages: python" in content
+def test_codeql_runs_through_the_github_default_setup_only() -> None:
+    """Das Repo nutzt das GitHub-Default-Setup fuer Code-Scanning (python, actions, woechentlich).
+
+    Ein eigener CodeQL-Workflow waere eine zweite Konfiguration und liesse den Check ``analyze`` bei jedem
+    Lauf scheitern ("advanced configurations cannot be processed when the default setup is enabled").
+    """
+    workflows = ROOT / ".github" / "workflows"
+    assert not (workflows / "codeql.yml").exists(), "codeql.yml doppelt die Default-Konfiguration"
+    for workflow in sorted(workflows.glob("*.y*ml")):
+        assert "github/codeql-action/" not in workflow.read_text(encoding="utf-8"), workflow.name
 
 
 def test_pep621_maintainers_and_classifiers() -> None: