Showcase: Our pre-commit hook that runs a subset of CodeQL queries locally.

Wanted faster feedback on security issues before they hit CI. Running full CodeQL scans locally was too heavy. Built a pre-commit hook that runs a targeted subset of queries.

* Pulls down a specific CodeQL query pack (security-and-quality)
* Runs only the `javascript/security` and `javascript/quality` query suites
* Configured to analyze only staged changes for speed

Key setup:
- Uses the official CodeQL CLI.
- Caches the query pack and database between runs.
- Exits with non-zero on findings, blocking commit.

Takes our local dev loop from minutes to seconds for security checks. Lets devs catch common JS vulnerabilities (injection, XSS, etc.) pre-push.