[antuz123]

Bitcoin Keeper's cloud integration needs a matching protected-branch CodeQL baseline and a bounded check for its two scoped GitHub readers. This change aligns the CodeQL category and adds a manual access check.

The reader check runs only from sprint, verifies each intended read and denial of the opposite capability, and reports fixed pass/fail messages. It does not check out repository code, invoke a build, or publish API response contents. A separate workflow tests the negative controls without credentials. The existing public-only CodeQL guard and release/* branch coverage from #7165 are preserved.

Validation on e683dd818e3670bb5ff74da0c720a3b642e05572:

• GitHub Tests, Lint, cloud-reader contracts, local-validation gate and CodeQL analysis job: PASS.
• Official CodeQL comparison: NEUTRAL; the new category has no installed baseline yet. This is not a security-clearance claim.
• Local 17 Node controls, actionlint 1.7.12 on all three workflows, whitespace and remote/local byte comparison: PASS.
• All four files are under .github/; native tests are exempt under AGENTS.md. No app build or release was started.

Both finite-expiry, repository-selected reader secrets are stored. Installed as 6ca92373fbc8f8354c5550551ade224ce3ff9498. The access-only check passed: both intended reads succeeded and both opposite capabilities were denied. Logs contain no credential values or private API response content. This verifies reader scope, not an exact canonical source pin or native result. The owner instructed this setup chat: "No need of approvals." That waives the additional developer-review requirement for this setup-only PR and authorizes a one-time administrator merge. Existing protection rules remain unchanged. This grants no release authorization. Canonical source/window settings remain untouched, and full native integration, app acceptance and release authorization are separate.

[Copilot]

🟢 Approval recommended

The reviewed changes have no unresolved blocking issues, and all member assessments support approval.

No open issues 🎉

What changed in this PR

Adds protected-branch verification for scoped GitHub readers and aligns the CodeQL analysis category with the reviewed baseline.

Changes:

• Adds a manual, read-only workflow verifying approved and denied reader API access.
• Adds credential-free contract tests for permissions, failures, masking, and workflow safeguards.
• Pins relevant actions and configures the CodeQL category and processing behavior.

File	Description
.github/​workflows/​keeper-cloud-readers.yml	Manual protected-branch verification of the two scoped GitHub readers.
.github/​workflows/​keeper-cloud-reader-contracts.yml	Pull-request and sprint contract-test workflow.
.github/​workflows/​codeql.yml	Pinned actions and aligned CodeQL category and baseline configuration.
.github/​tests/​cloud-readers.test.cjs	Node contract tests for access boundaries, failures, masking, and workflow safeguards.

_{Review effort: Lite}