fix(ci): repair the two standing red checks — codeql init/analyze version split + stale hypatia reusable pin

Every PR has carried two red checks:

1. `analyze (actions, none)` (CodeQL — a REQUIRED check per the workflow's
   own comment): dependabot #670/#673 bumped `analyze`/`upload-sarif` to
   v4.36.3 (54f647b7) but left `init` at v4.36.2 (8aad20d1). The init step
   writes a config the newer analyze rejects:
     "Loaded a configuration file for version '4.36.2', but running 4.36.3"
   Fix: align `init` to the same v4.36.3 SHA. Also corrected the drifted
   "# v3.28.1" comments to the SHA's real version (comment said v3.28.1,
   SHA was v4.36.x — the drift is what hid the split).

2. `hypatia / Hypatia Neurosymbolic Analysis`: the wrapper pinned the
   standards reusable at d135b05 — the known estate CI-red master-cause pin.
   The reusable was fixed upstream in standards #428 (GITHUB_TOKEN),
   #441 (un-stale scanner cache — our exact "Cache not found ... exit 1"
   symptom), #445, #453. Fix: bump the pin to 5fa7a834e (#453), the latest
   commit touching the reusable.

Workflow-file change: pushed via WSL gh (workflow scope present).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -37,11 +37,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.28.1
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v3.28.1
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/hypatia-scan.yml

@@ -25,5 +25,5 @@ permissions:
   pull-requests: write
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5fa7a834e015f22c14d2de592ccc369caefa318a
     secrets: inherit