chore: adopt Biome + Stylelint, modernize CI/CD, add security/support docs, minor JS fixes

- Linting/format
  - Replace ESLint/Prettier with Biome; remove old configs; add `biome.json`; update scripts
  - Tailwind-friendly `.stylelintrc.yaml`; Stylelint and Biome pass
  - Enable Biome across `modules/**`; prune legacy JS globals; ignore oversized `devicon.json`

- Code fixes
  - `hb-theme.js`: avoid assignment-in-expressions; clearer dataset updates
  - `hugoblox-slides.js`: fix inner var scope (var → let); apply formatting

- CI/CD
  - Split lint/build workflows; add path filters; Node via Corepack (pnpm from package.json)
  - Hugo pinned to env `HUGO_VERSION`; add consistency check vs `starters/academic-cv/hugoblox.yaml`
  - Nightly starters matrix build (academic-cv, landing-page); CodeQL weekly; resource caches

- Workflows/Community
  - Greeter: switch to `pull_request_target`; add Contributor Guide to PR message
  - PR labeler for path-based labels

- Repo policies/docs
  - `CODEOWNERS` for `@gcushen`
  - `SECURITY.md`, `SUPPORT.md`
  - Documented branch protection in `.github/settings.yml`
  - Move `CODE_OF_CONDUCT.md` to `.github/`

- docs(zh): update `README.zh.md` translation

Notes:
- pnpm is sourced from `package.json: packageManager` via Corepack; no hard-coded pnpm versions in CI.

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+name: Security - CodeQL
+
+on:
+  schedule:
+    - cron: "0 3 * * 0"
+  push:
+    branches: [main]
+    paths:
+      - "**/*.js"
+      - "**/*.jsx"
+      - "**/*.ts"
+      - "**/*.tsx"
+      - "**/*.py"
+      - ".github/workflows/codeql.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "**/*.js"
+      - "**/*.jsx"
+      - "**/*.ts"
+      - "**/*.tsx"
+      - "**/*.py"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (CodeQL)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: "javascript-typescript,python"
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript-typescript"