Configure CodeQL to build and analyze ESM bundle only

[Copilot]

Success criteria

CodeQL analysis should:

• Build the ESM bundle before scanning
• Analyze only dist/webchat.esm.js
• Ignore source files, node_modules, and build artifacts
• Return non-empty scan results

How to test

1. Trigger the CodeQL workflow (push to main, create PR, or wait for Monday 15:40 UTC)
2. Verify the "Build ESM bundle" step completes successfully
3. Confirm CodeQL analysis runs on dist/webchat.esm.js
4. Check that scan results are populated (not empty)

Changes

.github/workflows/codeql.yml:

• Added Node.js 22 setup with npm cache for JavaScript/TypeScript jobs
• Added npm ci and npm run build:esm steps before CodeQL initialization
• Changed JavaScript/TypeScript build-mode from none to manual
• References CodeQL config file for path filtering

.github/codeql-config.yml:

• Restricts analysis to dist/webchat.esm.js only
• Excludes source files, node_modules, and test artifacts

The Actions workflow language analysis continues unchanged (no build required).

Security

• No security implications

Additional considerations

• This PR might have performance implications

Documentation Considerations

None - internal CI/CD configuration change.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[graymalkin77]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.