ci(codeql): separate production scans from test fixtures (#8450)

.github/codeql/production.yml

@@ -0,0 +1,15 @@
+name: REA production code
+
+# Match the existing default-setup scan's local-input threat model.
+threat-models: [local]
+
+# Keep the default query suite and all production roots, including bridge/,
+# install.sh, runtime scripts, release controllers, and GitHub Actions.
+# Exclude test inputs at extraction time so they cannot taint production callers.
+paths-ignore:
+  - tests
+  - scripts/fixtures
+  - "**/*.test.*"
+  - "**/*.fixture.*"
+  - "**/test_*.py"
+  - "**/*_test.py"