ci: harden to cpp-ci reusable; remove inline ci.yml + placeholder

Replaces the previous inline cmake/ctest matrix and the placeholder
required.yml with a single ci.yml that calls the org-wide `required`
aggregator with `lang: cpp` and the correct source-dir +
cmake-flags preserved from the prior workflow.

Pinned to resq-software/.github@6410acb (the commit introducing
cpp-ci.yml). Re-pin to the merge commit or tag after PR#12 lands.

Parity:
- os matrix: ubuntu + macos + windows (same as before)
- source: packages/resq-common (same)
- flag:   -DRESQ_COMMON_BUILD_TESTS=ON (same)

Additionally runs CodeQL for c-cpp and the full security-scan
suite via the reusable — upgrade from the prior CI.

Author: WomB0ComB0

.github/workflows/ci.yml

@@ -1,27 +1,51 @@
+# Copyright 2026 ResQ Software
+# SPDX-License-Identifier: Apache-2.0
+#
+# Thin CI wrapper. Dispatches to the org-wide reusable `required`
+# aggregator (which calls cpp-ci matrix + security-scan). Subsumes
+# the prior inline cmake/ctest workflow AND the placeholder
+# required.yml — both removed in the same PR.
+
 name: CI
 
 on:
   push:
     branches: [main]
-    paths: ["packages/**"]
+    paths: ["packages/**", ".github/workflows/ci.yml"]
   pull_request:
     branches: [main]
 
-jobs:
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: read
 
-      - name: Configure
-        run: cmake -B build -DRESQ_COMMON_BUILD_TESTS=ON packages/resq-common
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Build
-        run: cmake --build build --config Debug
+jobs:
+  gates:
+    uses: resq-software/.github/.github/workflows/required.yml@6410acba18c9fc79949643abd48f0a2d43994c62
+    with:
+      lang: cpp
+      cpp-os-list: '["ubuntu-latest","macos-latest","windows-latest"]'
+      cpp-source-dir: "packages/resq-common"
+      cpp-cmake-flags: "-DRESQ_COMMON_BUILD_TESTS=ON"
+      codeql-languages: '["c-cpp"]'
+    secrets: inherit
 
-      - name: Test
-        run: ctest --test-dir build --output-on-failure -C Debug
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    needs: [gates]
+    if: always()
+    steps:
+      - env:
+          R: ${{ needs.gates.result }}
+        run: |
+          set -eu
+          case "$R" in
+            success|skipped|"") echo "ok: gates=$R" ;;
+            *) echo "::error::gates reusable returned: $R"; exit 1 ;;
+          esac