fix: improve CodeQL security-severity lookup and Link Checker formatting

- Fix CodeQL security-severity lookup to join results with rule
  definitions via ruleId (severity is on rules, not results)
- Make Link Checker Results a visible heading with collapsible
  details for broken links list

Author: david-waltermire

.github/workflows/build.yml

@@ -263,7 +263,17 @@ jobs:
           for sarif in codeql-results/*.sarif; do
             if [ -f "$sarif" ]; then
               # Check for error level OR security-severity >= 7.0 (high/critical)
-              CODEQL_CRITICAL=$(jq -r '[.runs[0].results[] | select(.level == "error" or ((.properties["security-severity"] // "0") | tonumber >= 7.0))] | length' "$sarif" 2>/dev/null || echo "0")
+              # Note: security-severity is on rule definitions, not results, so we join via ruleId
+              CODEQL_CRITICAL=$(jq -r '
+                # Collect security-severity from driver and extension rules
+                (.runs[0].tool.driver.rules // []) as $driver_rules |
+                ([.runs[0].tool.extensions[]?.rules // []] | add // []) as $ext_rules |
+                ($driver_rules + $ext_rules | map({(.id): (.properties["security-severity"] // "0")}) | add // {}) as $severities |
+                [.runs[0].results[] | select(
+                  .level == "error" or
+                  (($severities[.ruleId] // "0") | tonumber >= 7.0)
+                )] | length
+              ' "$sarif" 2>/dev/null || echo "0")
               if [ "$CODEQL_CRITICAL" -gt 0 ]; then
                 echo "::error::CodeQL found $CODEQL_CRITICAL critical/high severity issue(s)"
                 FAILED=true
@@ -345,8 +355,7 @@ jobs:
     - name: Link Checker Summary
       if: ${{ !inputs.skip_linkcheck && always() }}
       run: |
-        echo "<details>" >> $GITHUB_STEP_SUMMARY
-        echo "<summary><strong>Link Checker Results</strong></summary>" >> $GITHUB_STEP_SUMMARY
+        echo "## Link Checker Results" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
         if [ -f "html-link-report.md" ]; then
           # Extract summary stats from the report
@@ -357,9 +366,14 @@ jobs:
           if [ "$ERRORS" -gt 0 ]; then
             echo ":x: **Found $ERRORS broken link(s)**" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
+            echo "<details>" >> $GITHUB_STEP_SUMMARY
+            echo "<summary>View broken links</summary>" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
             echo '```' >> $GITHUB_STEP_SUMMARY
             grep -E "^\[ERROR\]|^\[[45][0-9]{2}\]" html-link-report.md >> $GITHUB_STEP_SUMMARY
             echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "</details>" >> $GITHUB_STEP_SUMMARY
           elif [ "$TIMEOUTS" -gt 0 ]; then
             echo ":warning: **$TIMEOUTS link(s) timed out** (external sites may be slow)" >> $GITHUB_STEP_SUMMARY
           else
@@ -369,7 +383,6 @@ jobs:
           echo ":warning: No link check report found." >> $GITHUB_STEP_SUMMARY
         fi
         echo "" >> $GITHUB_STEP_SUMMARY
-        echo "</details>" >> $GITHUB_STEP_SUMMARY
     - name: Upload link check report
       if: ${{ !inputs.skip_linkcheck }}
       uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f