Repair CodeQL imported-module extraction and enforce diagnostic failures

[hideouts-io]

Purpose

Repair incomplete imported-module semantics in the Swift CodeQL analysis and retain a bounded explanation when extraction fails.

Current candidate

• Use the known compiling Xcode26.4.1/macOS26 scanner environment, fresh DerivedData, documented implicit-module/cache controls, whole-module compilation, and the advertised x86_64 destination.
• Preserve all71application and28test Swift inputs and native196test checks. Compile one auxiliary diagnostic helper under CodeQL so its source is also scanned.
• Reject every Swift extraction-error notification, including errors labeled level: none, before the separate SARIF upload job can execute.
• Summarize only closed module names, bounded public target/SDK identifiers, source argument counts, presence of exact emission-option tokens, and compiler error counts using the pinned formatter’s ERRO severity label. Retain this JSON for one day only after failure; no raw logs, compiler arguments, environment, or database artifacts are retained.
• Keep read-only extraction and isolated uploads, required checks, SHA pins, native CI, branding checks, and publication protections.

Verification

Local Swift6 compilation with warnings treated as errors, publication-boundary validation, and focused metadata allow/deny checks pass. The local metadata checks use representative primary-source log format and do not prove hosted extractor compatibility.

Fresh candidate native CI, Swift/TypeScript/Actions analyses, imported-module diagnostics, processed uploads, and the aggregate gate must pass before merge. The previous candidate extracted all100owned Swift inputs, passed196tests, and parsed the actual three-invocation metadata schema, but retained one compiler ambiguity. Its previous severity filter under-counted errors; fresh metadata totals must agree with SARIF before attributing an invocation. The rejected Xcode16.4 comparison also produced Testing ABI diagnostics. File success counts and zero unresolved AST nodes do not establish complete imported semantics.

No product release, deployment, signing, or notarization is performed by this PR.