ci: add one-shot CodeQL verification

Author: niakw

.github/workflows/codeql-verify-once.yml

@@ -0,0 +1,26 @@
+name: CodeQL verify once
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/triggers/codeql-verify"
+
+permissions:
+  contents: read
+  security-events: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Verify no open CodeQL alerts remain
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          open="$(gh api --paginate -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2026-03-10" "repos/${GITHUB_REPOSITORY}/code-scanning/alerts?state=open&per_page=100" --jq '.[] | .number' | wc -l | tr -d ' ')"
+          echo "open_codeql_alerts=$open"
+          test "$open" = "0"