fix(codeql): disable Default Setup before Advanced Setup analysis

Advanced Setup and Default Setup cannot run simultaneously — SARIF upload
fails with "cannot be processed when the default setup is enabled".

Added a pre-analysis step that calls the GitHub code-scanning API to switch
Default Setup to not-configured before CodeQL runs, eliminating the conflict.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/codeql.yml

@@ -22,6 +22,16 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Disable CodeQL Default Setup
+        # Advanced Setup (this workflow) and Default Setup cannot run simultaneously.
+        # This step switches Default Setup to not-configured so SARIF upload succeeds.
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api repos/${{ github.repository }}/code-scanning/default-setup \
+            -X PATCH \
+            -f state=not-configured || true
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with: