Apparently you have to put CodeQL paths-ignore statements in a separate yml file from the GitHub Actions workflow yml, and point to it by name. Trying that here.