chore: update CodeQL Actions to v4.37.4

[hermes-archham]

Summary

Replaces Dependabot PR #136 with the complete coordinated update required by this repository's immutable GitHub Actions policy.

Changes

• updates grouped github/codeql-action/init and analyze pins from v4.37.3 to v4.37.4 at verified commit f205ea1c3313d32999d8d6a48b4f6530d4437b38;
• synchronizes exact-SHA static assertions;
• documents that Dependabot automates weekly discovery/grouped proposals while immutable-SHA verification and merging remain reviewed maintenance;
• records the maintenance update in [Unreleased].

Upstream review

• independently resolved annotated tag v4.37.4 to the pinned commit;
• upstream commit has a valid GitHub verification;
• both init and analyze use the Node 24 runtime;
• release changes add optional repository-property handling for the tools input and update the default CodeQL bundle to 2.26.2;
• no input changes are required by this repository's workflow.

Validation

• 177 tests passed, one expected skip;
• Bash syntax passed for lifecycle and installer scripts;
• Python compilation passed;
• tracked YAML parsing passed;
• immutable Action reference inventory passed;
• old CodeQL SHA absent from current workflow/test surfaces;
• hash-locked strict MkDocs build passed;
• git diff --check passed;
• added-line public-safety scan passed.

Maintenance model

Dependabot remains enabled on a weekly schedule and already groups coupled CodeQL steps. Auto-merge remains intentionally disabled: each Action update requires release-note, tag/SHA, runtime, hosted-workflow, and maintainer review.

Supersedes #136.

[hermes-archham]

Exact-head verification

Exact head: 1452a987aaff44abcf175a170b598bbafee39d54

Upstream verification:

• annotated v4.37.4 tag peels to f205ea1c3313d32999d8d6a48b4f6530d4437b38;
• pinned upstream commit has valid GitHub verification;
• both CodeQL init and analyze use Node 24;
• no workflow input migration is required.

Local gates:

• 177 tests passed, one expected skip;
• Bash syntax, Python compilation, tracked YAML parsing, immutable Action inventory, old-SHA absence, git diff --check, and public-safety scan passed;
• hash-locked strict MkDocs build passed.

Hosted gates:

• Repository gates: 30815939599 — passed;
• PR CodeQL workflow: 30815939837 — passed;
• operator-bundle build/transfer: 30815939941 — passed; publication correctly skipped for a PR;
• manual exact-branch CodeQL dispatch: 30815953490 — passed.

PR is clean and remains draft for maintainer review.

[archham]

Looks great