fix: prevent fallback recursion and write proper Parquet in embed generate command

Fixes #994:
1. Prevent self-recursion in methods.py: generate_embeddings, embed_text,
   calculate_similarity, and pool_embeddings all registered themselves as
   custom methods, causing infinite self-calls when dispatch invoked them
   without explicitly passing method parameter.
   Fix: check custom_method is not the function itself before recursing.

2. Fix embed generate --output corrupt output: the CLI wrote
   json.dumps(result, default=str) which produced plaintext repr of numpy
   arrays (e.g. '[1.49e-01 4.85e-02 ...]') instead of proper Parquet.
   Fix: detect .parquet extension (case-insensitive), convert numpy array
   to pandas DataFrame with dim_* columns and id index, use to_parquet().
   Non-parquet extensions fall back to JSON with clear ImportError message.

3. Add pyarrow>=14.0.0 to core dependencies (previously only in
   ingest-parquet/ingest-arrow optional extras). The documented quick-start
   flow of embed generate --output ... requires pyarrow out of the box.
   (Note: pandas>=1.3.0 is already a core dependency; pyarrow is the
   missing piece.)

Note: .github/workflows/* files are excluded from this PR as they require
a token with workflow scope. Upstream workflows are unchanged.

.github/workflows/codeql.yml

@@ -1,97 +0,0 @@
-name: CodeQL
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: '30 1 * * 1'  # Every Monday 7 AM IST
-
-permissions:
-  contents: read
-  security-events: write
-  actions: read
-
-jobs:
-  analyze:
-    name: Analyze Python
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      # The CodeQL bundle download (github/codeql-action/init's "Setup CodeQL
-      # tools" step) streams a ~1GB tarball from GitHub's release CDN and
-      # does not retry on a transient connection reset (ECONNRESET) itself
-      # (github/codeql-action, unresolved as of v4 / CLI 2.26.1: the HTTP
-      # error is retryable but isn't retried internally). Since a `uses:`
-      # step can't be wrapped by a shell-level retry action, attempt init
-      # up to 3 times; each retry is a fresh download attempt with no
-      # meaningful state carried over from a failed attempt.
-      - name: Initialize CodeQL (attempt 1)
-        id: codeql-init-1
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
-        continue-on-error: true
-        with:
-          languages: python
-          queries: security-and-quality
-          config-file: .github/codeql/codeql-config.yml
-
-      - name: Initialize CodeQL (attempt 2)
-        id: codeql-init-2
-        if: steps.codeql-init-1.outcome == 'failure'
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
-        continue-on-error: true
-        with:
-          languages: python
-          queries: security-and-quality
-          config-file: .github/codeql/codeql-config.yml
-
-      - name: Initialize CodeQL (attempt 3)
-        id: codeql-init-3
-        if: steps.codeql-init-2.outcome == 'failure'
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
-        with:
-          languages: python
-          queries: security-and-quality
-          config-file: .github/codeql/codeql-config.yml
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
-        with:
-          category: "/language:python"
-          upload: false
-        id: codeql
-
-      - name: Upload SARIF (Advanced Setup only)
-        # Uploads results only when Default Setup is not active.
-        # If Default Setup is still enabled, this step skips gracefully
-        # instead of failing the workflow with HTTP 409.
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
-        with:
-          sarif_file: ${{ steps.codeql.outputs.sarif-output }}
-          category: "/language:python"
-          wait-for-processing: true
-        continue-on-error: true
-
-  # NOTE: Auto-dismissal by rule-id is intentionally removed.
-  # Dismissing every alert that matches a rule ID would silently suppress
-  # future real vulnerabilities of the same type. The alerts below were
-  # individually triaged and dismissed manually in the security-enhancement
-  # PR (alerts #12–#18). New alerts must be reviewed and dismissed by hand,
-  # or will auto-close when the underlying code no longer triggers them.
-  #
-  # If you need to dismiss a specific known-safe alert, pin its alert NUMBER
-  # here and remove it once CodeQL stops reporting it naturally. Example:
-  #
-  #   PINNED_ALERT_NUMBERS=(12 13 14 15 16 17 18)
-  #   for NUM in "${PINNED_ALERT_NUMBERS[@]}"; do
-  #     gh api repos/$REPO/code-scanning/alerts/$NUM \
-  #       -X PATCH -f state=dismissed -f dismissed_reason="false positive" \
-  #       -f dismissed_comment="<reason>"
-  #   done