docs: describe the CodeQL gate that is actually in place (#43)

Follow-up to the CodeQL centralisation. The operational docs still
describe the gate that was replaced.

## What was stale

CodeQL now calls the org's reusable analysis in `bymaxone/.github`,
which resolves the repository's visibility **through the API** rather
than through `github.event.repository.private`. The docs still described
the expression form.

The autopilot notes were wrong in a way an agent would act on: they
predicted **two skipped checks** while the repo is private. The reusable
reports one that **runs and passes** (`codeql / Repository visibility`)
and one that **skips** (`codeql / Analyze (<language>)`).

## Why the API instead of the expression

The `schedule` event carries no webhook payload — GitHub lists it as
*Not applicable* — so `github.event.repository` is null there and
`!null` evaluates to **true**. The expression form therefore fails open
on the weekly run: a private repository would analyse and then fail at
the SARIF upload.

## What was deliberately not changed

**Scorecard's description.** It still uses `if: ${{
!github.event.repository.private }}`, so rewriting both mentions would
have traded one wrong sentence for another. Its description now stands
on its own.

**`docs/tasks/phase-00-*` and CHANGELOG entries.** Those record what was
built at the time. Editing them would misstate the history rather than
fix a stale instruction — a reader looking for what phase 00 delivered
should find phase 00, not today.

Author: msalvatti

docs/AUTOPILOT.md

@@ -100,9 +100,12 @@ compose stack at a time (`docker compose down` between profile switches -
 ports 3001/3002/8080/6379 collide).
 
 **Expected-skip CI checks**: `codeql.yml` and `scorecard.yml` are committed
-from phase 00 but gated on `if: ${{ !github.event.repository.private }}`.
-While the repo is private they report **skipping** and count as pass, never
-as a failure. The cluster E2E job is behind `workflow_dispatch` until stable
+from phase 00 and produce no findings while the repo is private, but they gate
+differently. `codeql.yml` calls the org's reusable analysis, whose
+`codeql / Repository visibility` job **runs and passes** on every trigger while
+`codeql / Analyze (<language>)` skips; `scorecard.yml` gates on
+`if: ${{ !github.event.repository.private }}` and skips outright. A skipped job
+counts as pass, never as a failure. The cluster E2E job is behind `workflow_dispatch` until stable
 (a non-run is not a failure).
 
 ## Invariant greps

docs/TECHNICAL_SPECIFICATION.md

@@ -548,7 +548,7 @@ nginx rules (the honest part):
 The repository is **private today and will become public**. CI is written once, with public-only features gated, never deleted:
 
 - `ci.yml` (always on): install, typecheck, lint, unit (both apps, sequential steps), build, E2E job with a `redis:7` service container (cluster E2E behind a manual/`workflow_dispatch` trigger until runners prove stable).
-- `codeql.yml` and `scorecard.yml`: full workflows committed from day one, gated with a repository-visibility condition (`if: ${{ !github.event.repository.private }}`) so they activate automatically when the repo flips public. No secrets in code; demo values only.
+- `codeql.yml` and `scorecard.yml`: committed from day one and gated on repository visibility, so they activate automatically when the repo flips public. CodeQL calls the org's reusable analysis, which resolves visibility through the API, so the answer is the same on every trigger; Scorecard uses `if: ${{ !github.event.repository.private }}`. No secrets in code; demo values only.
 - Every phase merges through a PR with GitHub Copilot review requested and all findings addressed; CI green is a merge precondition from the very first PR.
 
 ## 20 · Out of Scope