[antuz123]

CodeQL currently ignores future release branches and tries to run in private testing copies that lack the paid Code Security feature. This change adds release/* push/PR coverage and restricts the analysis job to the public canonical repository.

Existing scan actions and permissions are preserved. A skipped private job is not a security pass; release acceptance still requires successful analysis of the actual release source through its existing verification gates. No app source, release credentials, paid products, or native jobs are changed.

Validation: workflow YAML and branch matching checked for sprint/dev/main and release/2.6.4, 2.6.5, 2.6.6; existing local-validation suite passes all 11 tests; git diff --check passes. This workflow-only change is exempt from native app validation under AGENTS.md.

This is one part of the cloud-setup takeover. Environment reviewer settings remain an administrator-access blocker, and existing Android/iOS failures remain unresolved. No production release is authorized or started.

[Copilot]

🟢 Approval recommended

The workflow-only changes address the stated coverage and repository-scope requirements with no unresolved review issues.

No open issues 🎉

What changed in this PR

Updates the CodeQL workflow to scan public release/* branches while skipping analysis in private testing repositories that lack Code Security.

Changes:

• Adds release/* push and pull-request coverage.
• Restricts CodeQL analysis to the public canonical repository.
• Preserves existing actions, permissions, and analysis configuration.

File	Description
.github/​workflows/​codeql.yml	Extends CodeQL triggers to release branches and limits execution to the public canonical repository.

_{Review effort: Lite}