fix: codeql push trigger, readme hero removal, docs hero css

[joshua-temple]

Problem

• The CodeQL workflow only ran on pull_request and a weekly schedule, so the CodeQL README badge never populated on the default branch.
• The root README embedded a wide hero illustration below the How it works heading that duplicated the docs site art.
• The docs splash landing page boxed the wide 662x343 hero image into Starlight's forced 400x400 square, clipping it.

Fix

• Add a push trigger on main to .github/workflows/codeql.yml so analysis runs on default-branch pushes and the badge populates.
• Remove the hero image and its now-empty centering wrapper from README.md, keeping the mascot avatar.
• Add targeted CSS in docs/src/styles/cascade.css overriding the Starlight hero image box to object-fit: contain with a 320px max-height and natural width, so the full image shows uncropped.

Verification

• actionlint on codeql.yml: clean.
• Docs build (astro build, Node 26): success, 9 pages, hero image optimized.
• go build ./... and go test ./...: all pass.