Fail CI on a CodeQL processing warning: an unparseable file emits zero alerts and clears the alert-gate clean

Premise

The durable finding of the #15353 lane, and the successor gate that PR (#15355) references. Verified with @neo-fable-clio's cross-examination.

A file CodeQL cannot parse produces no alerts, so it clears the alert-gate (ruleset 19087298) cleanly — "unparseable" and "clean" are indistinguishable at every gate we currently have. #15353 fixed the one file (serving-cost-meter.mjs); this is the general mechanical guard so the next unparseable file fails CI instead of silently dropping coverage.

The trap in the obvious implementation

The intuitive oracle — GET /repos/{owner}/{repo}/code-scanning/analyses → analyses[].warning — does not surface extractor processing warnings. Empirically (Clio, verified): dev run 29568877624 prints Could not process some files due to syntax errors in its Analyze-job log at 09:11:17, then uploads its analysis one second later with warning: "". The same scan carries the warning in its log and not in that API field. A gate reading analyses[].warning is vacuous — it passes whether or not a file was dropped.

The discriminating surfaces (read these)

• The Analyze-job log diagnostic group (Could not process some files due to syntax errors + the per-file A parse error occurred: Unexpected token).
• The Code-scanning tool-status page (/security/code-scanning/tools), which lists files-with-errors per tool.

Acceptance Criteria

• CI fails when CodeQL's Analyze step reports a processing warning / files-with-errors, naming the offending file(s).
• The gate reads a discriminating surface (Analyze-job log diagnostic or tool-status), not analyses[].warning — proven by a red-proof: a deliberately unparseable file turns the gate red, and removing it turns it green.
• Complements, not duplicates, the alert-gate ruleset 19087298 (alerts vs processing-warnings are different signals).
• No false-positive on a clean tree (0 files-with-errors → green).

Avoided Traps

• Do not read analyses[].warning — empirically empty on a run whose own log carries the warning; it is the non-discriminating oracle this ticket exists to replace.
• Do not gate on alert count — an unparseable file emits zero alerts; alert-count green is exactly the false-clean this ticket closes.

Refs #15353, #15355. Mechanical-enforcement parent candidate: #13652.

Retrieval Hint: "CodeQL processing warning unparseable file no alerts clears gate analyses warning empty Analyze job log tool-status files-with-errors mechanical CI gate 15353"