ci(workflows): split label policy checks from workflow sanity (#559)

* fix(workflows): standardize runner configuration for security jobs

* ci(actionlint): add Blacksmith runner label to config

Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config
to suppress "unknown label" warnings during workflow linting.

This label is used across all workflows after the Blacksmith migration.

* fix(actionlint): adjust indentation for self-hosted runner labels

* feat(security): enhance security workflow with CodeQL analysis steps

* fix(security): update CodeQL action to version 4 for improved analysis

* fix(security): remove duplicate permissions in security workflow

* fix(security): revert CodeQL action to v3 for stability

The v4 version was causing workflow file validation failures.
Reverting to proven v3 version that is working on main branch.

* fix(security): remove duplicate permissions causing workflow validation failure

The permissions block had duplicate security-events and actions keys,
which caused YAML validation errors and prevented workflow execution.

Fixes: workflow file validation failures on main branch

* fix(security): remove pull_request trigger to reduce costs

* fix(security): restore PR trigger but skip codeql on PRs

* fix(security): resolve YAML syntax error in security workflow

* refactor(security): split CodeQL into dedicated scheduled workflow

* fix(security): update workflow name to Rust Package Security Audit

* fix(codeql): remove push trigger, keep schedule and on-demand only

* feat(codeql): add CodeQL configuration file to ignore specific paths

* Potential fix for code scanning alert no. 39: Hard-coded cryptographic value

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix(ci): resolve auto-response workflow merge markers

* fix(build): restore ChannelMessage reply_target usage

* ci(workflows): run workflow sanity on workflow pushes for all branches

* ci(workflows): rename auto-response workflow to PR Auto Responder

* ci(workflows): require owner approval for workflow file changes

* ci: add lint-first PR feedback gate

* ci(workflows): split label policy checks from workflow sanity

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

.github/workflows/workflow-sanity.yml

@@ -62,47 +62,3 @@ jobs:
 
             - name: Lint GitHub workflows
               uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
-
-    contributor-tier-consistency:
-        runs-on: blacksmith-2vcpu-ubuntu-2404
-        timeout-minutes: 10
-        steps:
-            - name: Checkout
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-            - name: Verify contributor-tier parity across workflows
-              shell: bash
-              run: |
-                  set -euo pipefail
-                  python3 - <<'PY'
-                  import re
-                  from pathlib import Path
-
-                  files = [
-                    Path('.github/workflows/labeler.yml'),
-                    Path('.github/workflows/auto-response.yml'),
-                  ]
-
-                  parsed = {}
-                  for path in files:
-                    text = path.read_text(encoding='utf-8')
-                    rules = re.findall(r'\{ label: "([^"]+ contributor)", minMergedPRs: (\d+) \}', text)
-                    color_match = re.search(r'const contributorTierColor = "([0-9A-Fa-f]{6})"', text)
-                    if not color_match:
-                      raise SystemExit(f'failed to parse contributorTierColor in {path}')
-                    parsed[str(path)] = {
-                      'rules': rules,
-                      'color': color_match.group(1).upper(),
-                    }
-
-                  baseline = parsed[str(files[0])]
-                  for path in files[1:]:
-                    entry = parsed[str(path)]
-                    if entry != baseline:
-                      raise SystemExit(
-                        'contributor-tier mismatch between workflows: '
-                        f'{files[0]}={baseline} vs {path}={entry}'
-                      )
-
-                  print('contributor tier rules/color are consistent across label workflows')
-                  PY