chore: update CodeQL Actions to v4.37.7

[hermes-archham]

Summary

Replaces conflicted Dependabot PR #140 with the complete coordinated update from current main required by this repository's immutable GitHub Actions policy.

Changes

• updates grouped github/codeql-action/init and analyze from v4.37.6 to v4.37.7;
• keeps both steps pinned to verified immutable commit ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd;
• synchronizes the exact-SHA regression assertions;
• updates the unreleased maintenance record.

Upstream review

• annotated v4.37.7 tag independently peels to the pinned commit;
• init and analyze both use the Node 24 Action runtime;
• the public release change updates the default CodeQL bundle to 2.26.3;
• current workflow inputs remain supported.

Validation

• 177 tests passed, one expected skip;
• Bash syntax, Python compilation, tracked YAML parsing, and git diff --check passed;
• strict hash-locked MkDocs build passed;
• complete workflow Action inventory remains immutable-SHA pinned;
• prior CodeQL SHA is absent from current workflow/test surfaces;
• added-line public-safety scan passed.

Runtime and hosted exact-head results will be recorded after branch workflows complete.

[hermes-archham]

Exact-head verification

Exact head: d31edce5056987e3b564fa82dc4e2cb3f2192699

Upstream verification:

• annotated v4.37.7 tag independently peels to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd;
• both init and analyze use the Node 24 Action runtime;
• the release updates the default CodeQL bundle to 2.26.3; current workflow inputs remain supported.

Local gates:

• 177 tests passed, one expected skip;
• Bash syntax, Python compilation, tracked YAML parsing, and whitespace checks passed;
• strict hash-locked documentation build passed;
• complete immutable Action-reference inventory and added-line public-safety scan passed.

Hosted gates:

• Repository gates 32012419856 — passed;
• PR CodeQL 32012419906 — passed;
• operator-bundle build/transfer 32012419748 — passed; publication correctly skipped for a PR;
• manual exact-branch CodeQL 32012428258 — passed.

The PR is clean and mergeable. No product runtime, release compatibility, or validation evidence changed.

[archham]

OK