fix(ci): drop the CodeQL rule that only ever fires on generated code (#292)

cs/nested-if-statements has fired four times in this repository and every
one was inside System.Text.RegularExpressions source-generator output —
#157/#158 (2026-07-16, QueryBuilder.Pro) and #307/#308 (2026-08-17,
Core). Never once in code anyone wrote.

paths-ignore: **/obj/** was added for exactly this after the first pair
and did not stop the second, which is the part worth recording. For a
compiled language the extractor takes compilation units from the BUILD,
and generator output has no file in the checkout for a path filter to
match: it is reported under a synthetic obj/.../generated/… path that
never existed on disk. A path filter cannot reach it by construction, so
a third variation on the same tweak would have failed the same way.

Excluding the rule instead. It is a maintainability rule, not a security
one; SonarCloud already covers that ground for this repo; and a rule at a
100% false-positive rate across two different source generators will keep
firing every time a generator changes shape. paths-ignore stays — it is
still correct for anything a build genuinely leaves in the checkout.

The two open alerts were dismissed separately at the repository level,
since resolving a finding does not close its alert. Their first
justification said the build output "was never excluded from the CodeQL
paths", which is wrong — it was, since 3f0c0bd; both dismissals were
rewritten to state the real reason.

Author: thiagoluga

.github/codeql/codeql-config.yml

@@ -1,5 +1,22 @@
 name: "NeoReports CodeQL config"
 
+# Only reaches files that exist in the checkout. Kept because it is correct for anything
+# a build leaves behind on disk — but see query-filters below for why it is not enough.
 paths-ignore:
   - "**/obj/**"
   - "**/bin/**"
+
+# `cs/nested-if-statements` has fired four times in this repository and every one of them was
+# inside System.Text.RegularExpressions source-generator output — alerts #157/#158 (2026-07-16)
+# and #307/#308 (2026-08-17); never once in code anyone wrote. The paths-ignore above was added
+# for exactly this and did not stop it: for a compiled language the extractor takes compilation
+# units from the BUILD, and generator output has no checkout file for a path filter to match, so
+# it is reported under a synthetic `obj/.../generated/...` path that never existed on disk.
+#
+# Dropping the rule rather than dismissing its alerts one release at a time: it is a
+# maintainability rule, not a security one, SonarCloud already covers that ground for this repo,
+# and a rule that has produced a 100% false-positive rate across two source generators will keep
+# producing them every time a generator changes shape.
+query-filters:
+  - exclude:
+      id: cs/nested-if-statements

docs/STATUS-AND-BACKLOG.md

@@ -118,6 +118,23 @@ check-then-act rather than atomic — closing that needs a compare-and-swap on `
 an interface every custom store implements, for a race orders of magnitude smaller than the human one
 this closes.
 
+### 1c. CodeQL noise from source-generator output — **FIXED (2026-08-18)**
+
+`cs/nested-if-statements` fired four times in this repository and every one was inside
+`System.Text.RegularExpressions` source-generator output — #157/#158 (2026-07-16, QueryBuilder.Pro)
+and #307/#308 (2026-08-17, Core). Never once in code anyone wrote.
+
+`paths-ignore: **/obj/**` was added for exactly this and did not stop the second pair, which is the
+part worth remembering: for a **compiled** language the extractor takes compilation units from the
+*build*, and generator output has no file in the checkout for a path filter to match — it is reported
+under a synthetic `obj/.../generated/…` path that never existed on disk. A path filter cannot reach it
+by construction.
+
+Fixed by excluding the rule itself via `query-filters`, not by a third path tweak: it is a
+*maintainability* rule rather than a security one, SonarCloud already covers that ground here, and a
+rule at a 100% false-positive rate across two different generators will keep firing every time a
+generator changes shape.
+
 ### 2. CI hardening
 - **Fail (not skip) the Testcontainers integration tests when Docker is absent in CI.** — **done**:
   the five container `ServerFixture`s now swallow a start failure only through an exception filter,