ci: remove placeholder API gates and minimize permissions

[dDevAhmed]

Summary

Removes the fake coverage-success step, runs ESLint without modifying the checkout, removes global write permissions, and scopes CodeQL permissions to its job.

Security

Sensitive workflow change. Merge only after all checks pass and a human maintainer approves the exact head SHA.

Tracks V2-BE-044.

[dDevAhmed]

@dDevAhmed merge is blocked for head b031bdd873f64be9619917a7840ca20b83fea8be.

Required fixes:

• Build, Lint, and Test → Check generated artifact drift failed. Run npm ci && npm run build && git status --porcelain; either commit the required reproducible generated output or change the build/generator so CI does not mutate tracked files.
• Security Scans → Dependency audit failed. Run npm audit --audit-level=high, update the lockfile/dependencies or document and implement a narrowly reviewed mitigation—do not suppress the gate.
• Container Vulnerability Scan → Build Docker image failed. Run docker build -t truthbounty-api:test . and fix the Docker build.
• This workflow/security change also has no approving human maintainer review on the current SHA.

Please push a focused fix and include the local command results; the new head will be reviewed from the beginning.

[dDevAhmed]

@dDevAhmed this security/CI baseline was merged at head b031bdd873f64be9619917a7840ca20b83fea8be despite failed required checks and no human maintainer approval.

The merged gate is not validated:

• Build, Lint, and Test → Check generated artifact drift failed; lint, unit/integration, and migration tests were skipped.
• Security Scans → Dependency audit failed; TruffleHog and CodeQL were skipped.
• Container Vulnerability Scan → Build Docker image failed; Trivy was skipped.

Please open a focused remediation PR against the merge commit (or an approved revert), fix artifact reproducibility, high-severity dependency findings, and the Docker build, then prove npm ci, typecheck/lint/tests/migrations/build, npm audit --audit-level=high, docker build, Trivy, secret scanning, and CodeQL all execute and pass. Obtain independent exact-head human approval before merging. Issue #395 must remain open until the full gate is green.