fix(ci): include hidden VitePress configuration in CodeQL (#8486)

.github/codeql/production.yml

@@ -3,6 +3,12 @@ name: REA production code
 # Match the existing default-setup scan's local-input threat model.
 threat-models: [local]
 
+# Retain root traversal, including future production roots. Hidden directories
+# need their own root; use a directory so Python can share this configuration.
+paths:
+  - .
+  - docs/.vitepress
+
 # Keep the default query suite and all production roots, including bridge/,
 # install.sh, runtime scripts, release controllers, and GitHub Actions.
 # Exclude test inputs at extraction time so they cannot taint production callers.