chore: update CodeQL Actions to v4.37.6

[hermes-archham]

Summary

Replaces Dependabot PR #138 with the complete coordinated update required by this repository's immutable GitHub Actions policy.

Changes

• updates grouped github/codeql-action/init and analyze from v4.37.4 to v4.37.6;
• keeps both steps pinned to the verified immutable commit 5595ccaf912efad79be6eef63a5619ff05969be3;
• synchronizes the exact-SHA regression assertion;
• updates the unreleased maintenance record.

Upstream review

• annotated v4.37.6 tag independently resolves to the pinned commit;
• init and analyze both use the Node 24 Action runtime;
• release changes cover a CodeQL bundle-download fallback fix and the default remote configuration filename;
• this workflow does not use the affected remote config-file address form.

Validation

• 177 tests passed, one expected skip;
• Bash syntax, Python compilation, tracked YAML parsing, and git diff --check passed;
• strict hash-locked MkDocs build passed;
• complete workflow Action inventory remains immutable-SHA pinned;
• old CodeQL SHA is absent from current workflow/test surfaces;
• added-line public-safety scan passed.

Runtime and hosted exact-head results will be recorded after the branch workflows complete.

[hermes-archham]

Exact-head verification

Exact head: 888f19b01acdaac89a3dbe93e28f45c8fc74b15e

Upstream verification:

• annotated v4.37.6 tag independently peels to 5595ccaf912efad79be6eef63a5619ff05969be3;
• both init and analyze use the Node 24 Action runtime;
• the release changes are compatible with this workflow's current inputs.

Local gates:

• 177 tests passed, one expected skip;
• Bash syntax, Python compilation, tracked YAML parsing, and whitespace checks passed;
• strict hash-locked documentation build passed;
• complete immutable Action-reference inventory and added-line public-safety scan passed.

Hosted gates:

• Repository gates 31781958339 — passed;
• PR CodeQL 31781958353 — passed;
• operator-bundle build/transfer 31781958374 — passed; publication correctly skipped for a PR;
• manual exact-branch CodeQL 31781972423 — passed.

The PR is clean and mergeable. No product runtime, release compatibility, or validation evidence changed.

[archham]

OK