Update CodeQL Actions to 4.37.8

[hermes-archham]

Summary

• update CodeQL init and analyze together to the verified immutable v4.37.8 commit
• synchronize exact-SHA regression assertions and the unreleased maintenance record
• preserve Node 24 execution, least-privilege permissions, and the existing analysis configuration

Validation

• 177 tests passed with one expected skip
• Bash syntax and Python compilation passed
• all GitHub workflow YAML parsed successfully
• strict hash-locked MkDocs build passed
• whitespace and complete public-diff safety checks passed
• old CodeQL v4.37.7 SHA is absent from current workflow, test, and changelog surfaces

Supersedes #142 after exact-head hosted validation.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[hermes-archham]

Exact-head validation complete at a8f61b9e416f3656acabc419c2af254ad7029790. The v4.37.8 tag peels to the pinned commit; init and analyze use Node 24. Local 177-test, Bash, Python, workflow-YAML, strict hash-locked docs, whitespace, stale-SHA, and public-safety gates passed. Hosted Repository gates, PR CodeQL, operator-bundle build/transfer, and manual CodeQL run 32963287149 passed; release publication skipped as intended.

[archham]

OK