security: harden hash-pin script per review, add explicit CodeQL workflow

Sourcery review on #299 flagged two real gaps in the TestPyPI hash-pin
step: the wheel glob could silently match >1 file, and the extracted
hash wasn't validated before being written into the pin file. Both now
fail loudly instead of proceeding on bad input.

Also closes Scorecard SAST alert #54: CodeQL was running via GitHub's
"default setup", which Scorecard's static SAST check can't see (it only
recognizes an explicit codeql-action workflow). Switched to an explicit
.github/workflows/codeql.yml (python + actions, matching this repo's
actual content) and disabled default setup via the API to avoid the two
configurations conflicting.

Entire-Checkpoint: 8dc67c1349b0

Author: devopam

.github/workflows/codeql.yml

@@ -0,0 +1,55 @@
+name: CodeQL
+
+# Explicit workflow (replaces GitHub's "default setup") for two reasons:
+# 1. Scorecard's SAST check only recognizes a workflow file running
+#    github/codeql-action — "default setup" scans just as thoroughly but
+#    is invisible to that static check (scorecard alert #54).
+# 2. Running on `pull_request` (not just a schedule) gates every PR, not
+#    just periodic scans of main.
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "23 8 * * 3"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      # Required to upload SARIF results.
+      security-events: write
+      # Required to fetch the source.
+      contents: read
+      # Required for the "actions" language (workflow analysis).
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Matches this repo's actual content — pure Python plus the
+        # workflow files themselves. (Default setup had also flagged
+        # c-cpp from autodetection; there's no C/C++ source in the repo,
+        # only vendored build artifacts under the gitignored .venv/.)
+        language: ["python", "actions"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/publish.yml

@@ -127,8 +127,17 @@ jobs:
         # just dependency confusion.
         run: |
           VER="${GITHUB_REF_NAME#v}"
-          WHEEL="$(ls dist/mcpg-"${VER}"-*.whl)"
+          mapfile -t WHEELS < <(ls dist/mcpg-"${VER}"-*.whl)
+          if [ "${#WHEELS[@]}" -ne 1 ]; then
+            echo "::error::Expected exactly one wheel for mcpg==${VER} in dist/, found ${#WHEELS[@]}: ${WHEELS[*]}"
+            exit 1
+          fi
+          WHEEL="${WHEELS[0]}"
           HASH="$(python -m pip hash "$WHEEL" | sed -n 's/^--hash=sha256://p')"
+          if ! [[ "$HASH" =~ ^[0-9a-f]{64}$ ]]; then
+            echo "::error::pip hash output for $WHEEL did not look like a sha256 hex digest: '${HASH}'"
+            exit 1
+          fi
           echo "mcpg==${VER} --hash=sha256:${HASH}" > /tmp/mcpg-pin.txt
           for i in 1 2 3; do
             if python -m pip install --no-deps \