chore: exclude the two P/Invoke audit queries in codeql.yml (Standards §4.4)

.github/workflows/codeql.yml

@@ -49,10 +49,24 @@ jobs:
           # Analyse source only. obj/ and bin/ hold generated and compiled
           # output — e.g. the xUnit auto-generated entry point — so findings
           # there are noise against code no human maintains.
+          #
+          # query-filters excludes the two audit queries that fire on every
+          # P/Invoke declaration and call site (cs/unmanaged-code,
+          # cs/call-to-unmanaged-code). Native-backend packages (Keychain,
+          # libsecret, DPAPI) exist to call unmanaged code, so these are pure
+          # noise there and non-native repos have no P/Invoke for them to hit.
+          # This excludes ONLY those two queries — every other
+          # security-and-quality query still runs on the interop files, so no
+          # real finding is lost (STANDARD.md 4.4).
           config: |
             paths-ignore:
               - "**/obj/**"
               - "**/bin/**"
+            query-filters:
+              - exclude:
+                  id: cs/unmanaged-code
+              - exclude:
+                  id: cs/call-to-unmanaged-code
 
       # Explicit build rather than autobuild: these repos multi-target, and
       # autobuild has picked a single TFM in the past, silently analysing half

CHANGELOG.md

@@ -38,6 +38,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **CodeQL now excludes the two P/Invoke audit queries at the config level** (NextIteration.Standards
+  §4.4). A `query-filters` block in `codeql.yml` excludes exactly `cs/unmanaged-code` and
+  `cs/call-to-unmanaged-code` — audit queries that fire on every P/Invoke into Keychain,
+  libsecret, and DPAPI and that no code change can resolve (native interop is the point).
+  Every other `security-and-quality` query still runs on the interop files, so no real
+  finding is lost. This replaces the per-alert *won't fix* dismissals, which reopened
+  whenever a reformat shifted a line number.
+
 - **Enabled `EnforceCodeStyleInBuild`** (NextIteration.Standards §1.2.1, now a `MUST`). The
   canonical `.editorconfig`'s gated rules now fail the build instead of merely showing in
   the IDE, so the house style is enforced. Bringing the code green under the flag was a