improvement(ci): run the CodeQL cron weekly and cancel superseded scans

Author: waleedlatif1

.github/workflows/codeql.yml

@@ -41,13 +41,15 @@ on:
     # Safety net behind the push trigger, and the thing that keeps the
     # default-branch alert view fresh when main is quiet. Only fires once this
     # file is on the default branch — schedule events ignore other branches.
-    - cron: '17 8 * * *'
+    # Weekly, not daily: main is already fully scanned on every merge.
+    - cron: '17 8 * * 1'
   workflow_dispatch:
 
-# Scheduled main scans must run to completion — only PR pushes supersede.
+# Only the newest analysis of a ref feeds the alert view, so superseded runs are
+# safe to drop. A merge to main can cancel the weekly scan; the push supersedes it.
 concurrency:
   group: codeql-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true
 
 permissions:
   contents: read