Allow CodeQL to run on demand

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     branches:
       - master
+  # On demand, so a CI change can be verified green without pushing a commit
+  # to trigger it.
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/codeql.yml

@@ -1,9 +1,17 @@
 name: CodeQL
 
-# Replaces CodeQL default setup. Default setup pins its own Go toolchain and
-# runs the extractor with GOTOOLCHAIN=local, so it cannot build a module whose
-# go directive is newer than the bundle. Driving it here lets setup-go install
-# the toolchain go.mod asks for, so a Go bump never blocks code scanning.
+# Replaces CodeQL default setup. Both of them: Settings has a Code security
+# default setup and a separate Code quality default setup, and each one spawns
+# its own CodeQL run. Both are now off, and both are replaced by this workflow.
+#
+# They pin their own Go toolchain and run the extractor with GOTOOLCHAIN=local,
+# so neither can build a module whose go directive is newer than the bundle.
+# Driving CodeQL here lets setup-go install the toolchain go.mod asks for, so a
+# Go bump never blocks code scanning.
+#
+# Their runs are titled "Code Quality: ..." and "PR #N" in the Actions list and
+# have event "dynamic". If one reappears, a default setup got re-enabled in
+# Settings; neither is fully manageable over the REST API.
 
 on:
   push:
@@ -16,6 +24,9 @@ on:
     # Weekly, Tuesday 05:44 UTC. Off the top of the hour and off the Security
     # workflow's Monday slot.
     - cron: '44 5 * * 2'
+  # On demand, so a scanning change can be verified green without pushing a
+  # commit to trigger it.
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

CONTRIBUTING.md

@@ -81,6 +81,25 @@ Follow the patterns documented in `AGENTS.md` and `documentation/architecture.md
 - The PR description must include a clear summary, a test plan, and any breaking change notes.
 - Do not push generated artefacts (`out/`, `bin/`, `.env`, IDE files). The `.gitignore` covers these.
 
+## Merging
+
+`master` is protected. `lint`, `test`, `Analyze (go, manual)` and `Analyze (actions, none)`
+must pass before a PR can merge, and the branch must be up to date with `master` first.
+Force-pushing and deleting `master` are blocked. Administrators can override, for
+emergencies only.
+
+Two rules the protection cannot enforce on its own:
+
+- Never merge on a red check, including one you believe is stale. A check that is
+  genuinely obsolete still has to be re-run green before the merge. If it cannot
+  re-run, push a commit so the checks re-evaluate on a fresh SHA.
+- After changing CI or code scanning configuration, confirm a fresh fully green run
+  before merging the change that depends on it. Configuration changes on the GitHub
+  side can take minutes to take effect, so a run started near the change may still
+  reflect the old setup. CI, Security, Integration and CodeQL all carry a
+  `workflow_dispatch` trigger for exactly this check. Release is driven by its tag
+  and is deliberately not dispatchable.
+
 ## Reporting bugs
 
 Open an issue with: