[ankitTelnyx]

Summary

• Add production-owned advanced CodeQL with unchanged Analyze (actions) / Analyze (java-kotlin) names on GitHub-hosted ubuntu-latest.
• Select JDK21 before tracing; compile all main Kotlin/Java sources using clean classes, no caches/incremental compilation, single worker and in-process Kotlin.
• Follow-up uses the established CI compiler budget: 12GiB heap / 1GiB metaspace, not the insufficient 8GiB cap. No generated source or Gradle configuration changed.
• Preservation PR https://github.com/team-telnyx/telnyx-java-staging/pull/347 is merged; both promotion paths retain production-owned workflow/test bytes.

Diagnosis and evidence

At previous head 3f97e7c34f727509f16c1b9ce97b951cf8ec989d, advanced run https://github.com/team-telnyx/telnyx-java/actions/runs/39655002870/job/119412820724 selected Temurin21 / Gradle8.12 but failed :telnyx-core:compileKotlin with Kotlin psi2ir OutOfMemoryError: Java heap space at 8GiB. The original local build also terminated with heap exhaustion; it is no longer running.

The same-head ordinary hosted CI build https://github.com/team-telnyx/telnyx-java/actions/runs/39655002782/job/119412935347 actually compiled core Kotlin (not a skipped/cache-only task) and finished BUILD SUCCESSFUL in 14m 20s with in-process -Xmx12g / 1GiB metaspace. Reusing that budget is the minimal evidence-based correction. Traced compilation still requires its own exact-head proof.

Verification at current head

Head: 8031869abdec811ee3292b506a028822aa7c81cf.

• New budget regression fails against old 8GiB workflow (RED) and passes after correction (GREEN).
• Focused policy suite: 7 passed; complete Python policy suite: 78 passed.
• actionlint .github/workflows/codeql.yml and git diff --check: pass.
• New exact-head hosted compilation is pending, not claimed successful. Earlier ordinary CI success is supporting evidence, not proof of traced compilation.

Security setup / merge boundary

Default CodeQL remains configured for actions and java-kotlin. Prior advanced actions upload was rejected because default setup is enabled; this is a separate, expected activation gate. No settings changes, merges, release publication, or auto-merge enrollment performed. Do not disable default setup to make this PR green. Full advanced analysis/upload acceptance requires separately authorized cutover. Preserve check names and distinguish .github/workflows/codeql.yml runs from dynamic/default CodeQL runs with identical names.