Name the release the CodeQL pin carries, so the audit can read it [#19]

[iderex]

Part of #19, and it does not meet that issue's done condition. The last section
says what is still owed there.

What was wrong

Two steps pinned a commit and named a major line beside it rather than a
release. #19 already recorded that shape and said what it would cost. It has now
cost it: the v4 tag moved off the pinned commit, and the workflow audit refuses
the mismatch on every pull request opened against this repository.

gh run view 31724225854 --log-failed | grep -c 'ref-version-mismatch'
2

Run 2026-08-13. The same audit passed on main earlier today against the same
two lines, so nothing in this tree changed:

gh run list --workflow=zizmor.yml --branch=main --limit 2 \
  --json conclusion,createdAt,headSha \
  --jq '.[]|"\(.conclusion) \(.createdAt) \(.headSha[0:7])"'
success 2026-08-13T12:41:34Z 269d93e
success 2026-08-13T08:28:22Z 27c9e9a

Run 2026-08-13. What moved is upstream.

What the change does

Only the comment. Both steps ran 5595ccaf912efad79be6eef63a5619ff05969be3
before this change and run it after, and the whole diff is two comments:

git diff --stat origin/main...HEAD
 .github/workflows/codeql.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

The release that points at the pinned commit, dereferenced through the annotated
tag rather than read off the ref:

gh api repos/github/codeql-action/git/ref/tags/v4.37.6 --jq '"\(.object.type) \(.object.sha)"'
tag 9e3211c9a3b9311dfe05da2ed48eea3386f042dd
gh api repos/github/codeql-action/git/tags/9e3211c9a3b9311dfe05da2ed48eea3386f042dd --jq '.object.sha'
5595ccaf912efad79be6eef63a5619ff05969be3

and the line the comment used to name, which is now a different commit:

gh api repos/github/codeql-action/git/ref/tags/v4 --jq '.object.sha'
988661ebb5e81487b3fb31b2185d2856c0a10679
gh api repos/github/codeql-action/git/tags/988661ebb5e81487b3fb31b2185d2856c0a10679 --jq '.object.sha'
ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd

All run 2026-08-13. The other three pins of the same action already name a
release and the audit does not report them:

grep -rn 'codeql-action' .github/workflows/ | grep -c '# v4[.]'
3

What failure this prevents

Not the red run, which is the symptom. A pin whose comment names a moving
reference cannot be read against what it claims to be, so an update that
replaced the commit and one that did not look identical to the next reader. That
is the property #19 asks the updater to preserve, stated from the other end.

The gate

go run . ci | tail -2
  invariants: ok, 34 rule(s) decided, 1 owed and not decided
6 of 6 legs ran. None was skipped.
go run . hygiene origin/main HEAD | tail -1
1 commit(s) judged, none refused.

Both run 2026-08-13 at 7b9c94b. No leg of the gate reads a workflow file for
this property; the audit that does runs on the server, and its verdict on this
branch is what stands behind the change.

The means

YAML, because the file is a workflow and the comment beside a pin is what the
audit reads. Nothing else was available and nothing was added.

What is not covered

#19's done condition asks for an observed update pull request with the SHA pin
and the version comment preserved. This is not that: it is a comment corrected by
hand because the audit went red, and no updater has opened anything here yet.
That clause stays owed.

Reader

This change carries no second reader. Every claim above is a command, and the
one that matters is the pinned sha being unchanged, which the diff shows in full.