ci(codeql): delegate PR CodeQL to central, keep local push-only (fixes duplicate check contexts)

.github/workflows/codeql.yml

@@ -5,10 +5,6 @@ on:
     branches:
       - develop
       - master
-  pull_request:
-    branches:
-      - develop
-      - master
   workflow_dispatch:
 
 permissions:
@@ -55,7 +51,8 @@ jobs:
         with:
           category: "/language:${{ matrix.language }}"
           # This repository uses GitHub CodeQL default setup for code scanning
-          # uploads. Keep this workflow as CI/Scorecard SAST evidence without
-          # uploading duplicate CodeQL SARIF, which GitHub rejects while
-          # default setup is enabled.
+          # uploads, and PR CodeQL is delegated to the central
+          # ContextualWisdomLab/.github codeql-pr.yml. Keep this workflow as
+          # push-only CI evidence without duplicate SARIF upload or duplicate
+          # PR check contexts.
           upload: never

backend/tests/test_release_governance.py

@@ -422,7 +422,10 @@ def test_bandit_security_scan_does_not_continue_on_error() -> None:
     assert "continue-on-error: true" not in workflow
 
 
-def test_codeql_workflow_can_read_security_events_without_uploading_sarif() -> None:
+def test_codeql_workflow_scans_default_branch_only_without_uploading_sarif() -> None:
+    # PR CodeQL and the code_scanning ruleset merge gate are delegated to the
+    # central ContextualWisdomLab/.github codeql-pr.yml. The local workflow runs
+    # only as push/manual CI evidence and avoids duplicate SARIF uploads.
     workflow = read_repo_text(".github/workflows/codeql.yml")
 
     assert "permissions:\n  contents: read\n  security-events: read" in workflow
@@ -432,6 +435,12 @@ def test_codeql_workflow_can_read_security_events_without_uploading_sarif() -> N
     )
     assert "upload: never" in workflow
     assert "security-events: write" not in workflow
+    assert "pull_request:" not in workflow
+    assert "analyze-merge:" not in workflow
+    assert "CodeQL merge preview" not in workflow
+    assert "refs/pull/" not in workflow
+    assert "- develop" in workflow
+    assert "- master" in workflow
 
 
 def test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif() -> None: