fix(ci): drop the CodeQL visibility guard that blocked every merge

`if: github.event.repository.visibility == 'public'` sat on a matrix job. A
job-level `if:` is evaluated before the matrix expands, so every skipped run
reported one check under the raw template name, `analyze (${{ matrix.language
}})`, instead of `analyze (java-kotlin)` and `analyze (javascript-typescript)`.

While the repository was private that phantom name was the only CodeQL check
anyone had seen, so it was pinned as a required status check in the `Protect
main branch` ruleset. When the repository went public the job began running for
real and reporting the two expanded names, leaving the required phantom with
nothing to report it. Every pull request then stalled on "Expected — waiting
for status to be reported": unmergeable, and with no failing job to point at,
indistinguishable from CI being stuck.

The guard has served its purpose — the repository is public and code scanning
is free, which is the condition its own comment named for deleting it. The
replacement comment records the failure mode so the `if:` is not reintroduced,
and says to fix a future private repository in the ruleset instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: geekypunk

.github/workflows/codeql.yml

@@ -18,13 +18,19 @@ jobs:
   analyze:
     name: analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
-    # Code scanning is free on public repositories; on a private one it requires
-    # GitHub Advanced Security, which this organisation's free plan does not
-    # include. Without this guard every run fails with a 403 until the repository
-    # is public, and a permanently red workflow trains people to stop reading CI.
-    # DELETE THIS LINE once the repository is public — from then on a failure
-    # here is a real finding rather than a billing state.
-    if: github.event.repository.visibility == 'public'
+    # No visibility guard here, deliberately. A job-level `if:` is evaluated
+    # before the matrix expands, so a skipped run reports a single check under
+    # the raw template name — `analyze (${{ matrix.language }})` — rather than
+    # the two expanded names. That phantom name reached the `Protect main branch`
+    # ruleset as a required check (GitHub's suggestion list offers whatever was
+    # last reported), and once this repository went public and the job began
+    # reporting the real names instead, nothing was left to satisfy the phantom:
+    # every pull request stalled on "Expected — waiting for status to be
+    # reported", unmergeable, with no failing job to point at.
+    #
+    # Code scanning is free while this repository is public. If it ever goes
+    # private without GitHub Advanced Security, drop these contexts from the
+    # ruleset — do not reintroduce an `if:` here.
     permissions:
       # Required to upload results to the code-scanning API.
       security-events: write