ci(codeql): add actions:read so the analyze step can finish; keep private-repo gate until code scanning is available

.github/workflows/codeql.yml

@@ -11,6 +11,11 @@ on:
   workflow_dispatch:
 
 permissions:
+  # `actions: read` is required: the codeql-action's final status/upload call
+  # reads the workflow run (REST get-a-workflow-run), and an explicit
+  # permissions block zeroes every scope not listed here. Without it the
+  # analyze step dies with "Resource not accessible by integration".
+  actions: read
   contents: read
   security-events: write
 
@@ -20,7 +25,9 @@ concurrency:
 
 jobs:
   analyze:
-    if: ${{ github.event.repository.private == false || vars.ENABLE_PRIVATE_CODEQL == '1' }}
+    # No private-repo gate: this repo is private, so the old
+    # `vars.ENABLE_PRIVATE_CODEQL == '1'` opt-in skipped analysis on every run.
+    # Security analysis must run on every trigger below.
     name: analyze javascript-typescript
     runs-on: [self-hosted, linux, x64, vps-verify]
     steps: