Repair CodeQL imported-module extraction and enforce diagnostic failures

[hideouts-io]

Purpose

Repair incomplete imported-module semantics in Swift CodeQL analysis while retaining a strict extraction-quality gate and bounded failure evidence.

Current state: blocked on one extractor diagnostic

The latest CodeQL run at ec5118a completed its Xcode 26.6 build and all three language analyses, but the Swift SARIF still contains one swift/diagnostics/extraction-errors notification at level: none: reference to 'NSAccessibilityElement' is ambiguous. It has no owned-source location. The gate correctly rejected it; upload jobs were skipped and CodeQL results failed. This PR is not ready to merge.

The bounded invocation summary agrees with SARIF: zero compiler errors in the diagnostic helper and app invocations, and one in SystemProfilerExplorerTests (28 source arguments). The tested runner used Xcode 26.6 / Apple Swift 6.3.3 / MacOSX26.5.sdk. All 100 Git-owned Swift paths match the expected and located extracted path sets. This file count, zero unresolved AST nodes, and zero security query results do not establish complete imported-module semantics.

The Xcode 26.6 selection and version-report step are a recorded compatibility trial, not a correction for this diagnostic. The same ambiguity was present with Xcode 26.4.1 in the previous run. A public CodeQL issue independently reproduces this ambiguity with valid PDFKit source; that report does not prove which import causes this repository's test-module diagnostic or provide a supported remedy.

Scope retained

• Build the app and tests under CodeQL with fresh DerivedData, disabled compile caching and explicit Swift modules, whole-module compilation, and a single advertised architecture.
• Reject every Swift extraction-error notification, including level: none, before the separate SARIF upload job can execute.
• Retain only a bounded summary of module names, public target/SDK identifiers, source argument counts, exact emission-option presence, and compiler error counts after failure. Do not retain raw extractor logs, compiler arguments, environment, or databases.
• Keep source extraction read-only, result uploads isolated, SHA-pinned Actions, native CI, branding checks, publication protection, and the strict three-language gate.

Verification and remaining work

Local publication-boundary check, branding type check, Swift 6 helper compilation with warnings treated as errors, and Xcode 27 native build/tests passed: 195 passed, one optional private-fixture skip, zero failed. Hosted native CI passed at this head; the hosted 196-test total likewise includes that optional skip. JavaScript/TypeScript and Actions CodeQL analyses passed. Swift SARIF still has the one diagnostic above; processed uploads and the aggregate CodeQL gate did not pass.

Resolve the extractor diagnostic without suppressing it or excluding source/tests, then rerun Swift extraction and compare SARIF with bounded invocation evidence. Require zero compiler diagnostics, complete owned-path coverage, processed uploads for all three languages, and a passing aggregate gate at the candidate revision. The newer app work in PR #18 must be checked again when combined with this workflow.

No product release, deployment, signing, or notarization is performed by this PR.