fix: update CodeQL actions to SHA-pinned v3 (29b1f65c) (#82)

Bumps `github/codeql-action/init` and `github/codeql-action/analyze`
from pin `e4fba868` to `29b1f65c` (current v3), keeping full-SHA
pinning.

This hand-applies the update Dependabot has been unable to deliver — its
daily run currently fails with 403 `git_dependencies_not_reachable` on
the private `a2ml-validate-action` / `k9-validate-action` repos before
completing the actions-group update (see
`dev-notes/tangle-sitrep-2026-07-27.md`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -33,11 +33,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3.37.3
         with:
           category: "/language:${{ matrix.language }}"