governance: codeql.yml lacks SPDX header and top-level permissions (Workflow security linter red) #53

governance / Workflow security linter is red on main (1d0fb8b3) and on #51:

ERROR: .github/workflows/codeql.yml missing SPDX header
ERROR: .github/workflows/codeql.yml missing top-level 'permissions:' declaration

codeql.yml is the unmodified GitHub starter file. #51 does not touch any workflow.

Acceptance criteria

• codeql.yml carries the SPDX header and a top-level permissions: map (least privilege, with security-events: write at job level where the upload needs it).
• governance / Workflow security linter is green on main.
• The edit follows AGENTS.md §2a for YAML: convert to KYAML only once this repo's gates read KYAML (governance pin at or after 13b872c1, and no grep "^permissions:"-style linter). Note that the failing linter is exactly such a regex, so it must be fixed or the file kept in block YAML.

Deferred from #51 per AGENTS.md §5c item 3.