[gaborbernat]

Routine CI hygiene for the release and workflow setup, plus adoption of the shared tox-dev/github-workflows 6.5.0 check, CodeQL and release workflows.

Hygiene:

• Pin every tox-dev/github-workflows reference, including the untagged scorecard pin, to 6.4.0. Nothing in 6.2.2 through 6.4.0 renames or removes an input these callers pass.
• Align astral-sh/setup-uv to v10.3.3 and CodeQL to v4.39.1 where a workflow pins an older version.

Adoption:

• Pin every reference to 6.5.0.
• check.yaml passes the tox matrix to the reusable workflow as include. The caller keeps the 🧪 Test job and the 🚦 Required checks pass gate, which now calls the required-checks action instead of an inline jq expression. Tox installs under the 7-day upload cutoff, as the shared workflow does for every repository.
• codeql.yaml runs the analysis through the reusable workflow. The caller keeps its triggers and the tests path exclusion.
• Release: release-notes.yaml renders the GitHub Release body, and github-release.yaml verifies the PyPI files before it creates the Release. The PyPI publish job stays in the caller for trusted publishing. This replaces the local notes upload, previous-tag selection, reconcile and Release steps.
• [tool.nab]: the release-creator cutoff exception gets the # expires 2026-11-09 comment directly above it. Shared checks now fail an exception without that comment, which would have failed validate-news and the scheduled release-tool upgrade. The exception itself is unchanged.

Required checks are unchanged: 🚦 Required checks pass, 📝 News fragment and pre-commit.ci - pr keep their names. The test checks now read 🧪 Test / 🧪 <env> on ubuntu-26.04, and CodeQL reads 🛡️ Analyze / 🛡️ Analyze <language>.

Dependabot already covers github-actions and pre-commit with the 7-day cooldown, so no config change there.