fix(security): exclude benchmark fixture corpus from CodeQL analysis

.github/codeql/codeql-config.yml

@@ -0,0 +1,36 @@
+# CodeQL analysis configuration for PARTHA.
+#
+# Referenced by .github/workflows/codeql.yml via the `config-file` input.
+#
+# Why this file exists
+# --------------------
+# The Repository Intelligence golden benchmark corpus under
+# apps/backend/tests/benchmark/fixtures/ deliberately contains files that do
+# not parse. They are inputs to the RI engine, not code PARTHA executes:
+#
+#   adversarial/adv-py-malformed/src/broken.py   ->  def broken(:
+#   adversarial/adv-ts-malformed/src/broken.ts   ->  export function broken( {
+#
+# Each is pinned by a manifest asserting the RI-SRC-MALFORMED diagnostic
+# (RFC-0001 §4.3, §6.2, §8), so the malformed syntax IS the fixture contract —
+# "correcting" it would silently delete coverage of py.syntax_error and
+# ts.syntax_error from the benchmark.
+#
+# CodeQL cannot parse them either, and reported:
+#   "Could not process some files due to syntax errors"
+# once per language, which is the entire contents of the Security tab warning.
+# Excluding the fixture corpus removes the false signal without weakening any
+# analysis of real application code.
+name: PARTHA CodeQL config
+
+paths-ignore:
+  # Golden benchmark fixture corpus: adversarial inputs to the RI engine,
+  # intentionally including unparseable sources. Not application code.
+  #
+  # Both the bare directory and an explicit glob are listed. The bare path
+  # alone did not take effect on the first attempt (CodeQL still scanned
+  # 248/248 Python files and re-reported the parse errors), so the glob makes
+  # the intent unambiguous. Note `**` is only valid at the start or end of a
+  # segment, which is why this is `<dir>/**` and not `**fixtures**`.
+  - apps/backend/tests/benchmark/fixtures
+  - apps/backend/tests/benchmark/fixtures/**

.github/workflows/codeql.yml

@@ -77,6 +77,9 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
+          # Excludes the RI golden benchmark fixture corpus, which contains
+          # deliberately unparseable sources. See the config file for why.
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3