fix(ci): actually repoint codeql-action at a SHA that exists (#38)

`github/codeql-action@29b1f65c1f735799893313399435a59f54045865` **exists
in no repository** — the GitHub API returns 422 — so CodeQL could not
build its run graph and reported `startup_failure` in 0 seconds. This
repository has had **no CodeQL scanning at all**.

Repointed at `4187e74d05793876e9989daffde9c3e66b4acd07`, what the `v3`
tag resolves to (v3.37.3), verified against the API.

**Supersedes an earlier attempt** that branched from the local
checkout's HEAD rather than `origin/main`. Where the two had drifted,
that commit carried an unrelated diff and left the workflow untouched —
so the fix appeared to land while `main` still pinned the dead SHA.
Caught by verifying `main` estate-wide, not by the merge tally.\n\nThis
pass bases explicitly on `origin/main` and verifies the substitution
before committing.

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -33,13 +33,13 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/autobuild@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3