rule: extend codeql_language_matrix_mismatch to also recommend language: actions

[hyperpolymath]

Context

Hypatia.Rules.WorkflowAudit.check_codeql_language_matrix_mismatch/2 already detects language: javascript-typescript on repos without JS/TS source. It needs to be tightened to also recommend language: actions when the repo contains GitHub Actions workflows (which is ~every repo).

This is the failure class that blocked otpiser#11 and 30+ other PRs today. Root cause: three template repos (rsr-template-repo, mtpc-template-repo, thunderbird-template-reloaded) seeding the broken matrix in every newly-generated repo. Templates were fixed in rsr#71, mtpc#8, thunderbird#75 — this rule catches the long tail.

Rule extension

Augment the existing rule's fix field to include the canonical language: actions matrix, and add a positive recommendation when:

• .github/workflows/*.yml exists, AND
• codeql.yml does not list language: actions

has_actions_lang = String.contains?(codeql_yml, "language: actions")
has_workflows = Enum.any?(workflow_contents, fn {k, _} -> String.ends_with?(k, ".yml") end)

cond do
  has_workflows and not has_actions_lang ->
    {:fail, %{rule: :codeql_missing_actions_language, severity: :medium,
              path: ".github/workflows/codeql.yml",
              fix: "Add `- language: actions` to matrix.include (with build-mode: none)"}}
  # ... existing checks
end

Verification

Run against today's pre-fix SHAs of otpiser, kategoria-pipeline, nextgen-typing, rattlescript — all should fire. Today's sweep changed 17+ repos to language: actions.

Filed from session sweeping otpiser#11 + estate-wide drift.