Fix catalog CodeQL upload conflict with default setup

[yousefi-msft]

Summary

Prevent the catalog CodeQL workflow from submitting advanced-configuration SARIF while repository CodeQL default setup is enabled. Keep the catalog-scoped analysis and unconditional downloadable SARIF artifact, update the explanatory workflow comments, and lock the behavior with a regression assertion.

Type of change

• New agent (under agents/<name>/)
• Update to an existing agent
• New starter kit (under starter-kits/<name>/)
• Update to an existing starter kit
• Schema change (docs/schemas/**)
• Workflow / script change (.github/**)
• Documentation only
• Other (describe below)

Related issue / tracking

Refs https://github.com/microsoft/discovery/actions/runs/38660892813/job/116185358442 (run triggered by #163).

Schema impact

• No schema changes
• Schema changes are backward compatible
• Schema changes are breaking — add the breaking-change label and link the rollout plan below

Validation checklist

• Documentation (README.md, schemas) is updated to match the change.
• No hand-edits to .auto-registry/** (it is generated post-merge).
• No OS / editor artefacts committed (.DS_Store, .env, *.swp, .idea/, .vs/, etc.).
• If model-weight files are added, they are Git-LFS tracked, ≤5 GB each, and in an allowed format.
• No secrets, customer data, or internal-only URLs are committed.
• All Markdown links resolve.

Reviewer notes (optional)

The failed run completed analysis, then GitHub rejected processing with: "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled". This change disables only that incompatible CodeQL upload, not analysis or artifact retention. Existing PR reporting and push/scheduled error behavior are unchanged. Workflow comments document the reporting destination; no schemas or model weights change.

Validation:

• python -m pytest .github\tests\test_security_automation.py .github\tests\test_validate_pr_pol021.py -q — passed, 68 tests.
• git diff --check — passed before commit.
• A hosted Actions rerun has not been performed; local validation covers the workflow configuration contract, not GitHub's server-side SARIF processing.

The pre-existing ZINC parse diagnostic in the failed run is separate from the upload failure and is intentionally unchanged.