[Lopu] Complete durable queue and CodeQL handoff activation

[lopugit]

Outcome

Completes the post-merge activation audit for Lopu after #399.

• Preserves every pending repository signal with GitHub-valid queue: max plus cancel-in-progress: false.
• Internalizes the final public rebase/stack entry through Lopu PR manager.
• Splits CodeQL into an unprivileged analyzer and a protected metadata-only pull_request_target handoff so ordinary PR events never inherit actions: write.
• Retains partial-clone conflict workers and the single protected Lopu model action.

Live fault fixed

After #397/#399 merged, scheduled, comment, check, and push runs created zero jobs because queue: max was paired with a cancellation expression that could become true. Ordinary CodeQL PR runs were also rejected because a read-capped event called a reusable workflow containing an actions: write nested job.

Validation

• node .github/scripts/workflow-control-plane-contract.mjs --self-test
• node .github/scripts/promotion-worker-routing-contract.mjs
• all controller workflow YAML parsed successfully
• Graphify semantic refresh: 573 nodes / 1,212 edges, 45 communities

Merge this PR before the main listener follow-up.