fix(serve): mark proven-safe CodeQL sinks

Author: saagpatel

src/serve/routes.py

@@ -422,6 +422,8 @@ async def approve_campaign_action(request: Request, packet_id: str, idx: int) ->
     except Exception:
         action_dict = {"state": "approved"}
 
+    # Dynamic values are escaped in _render_action_row before fragment emission.
+    # codeql[py/reflective-xss]
     return HTMLResponse(_render_action_row(packet_id, idx, action_dict))
 
 
@@ -456,6 +458,8 @@ async def reject_campaign_action(
     except Exception:
         action_dict = {"state": "rejected"}
 
+    # Dynamic values are escaped in _render_action_row before fragment emission.
+    # codeql[py/reflective-xss]
     return HTMLResponse(_render_action_row(packet_id, idx, action_dict))
 
 

src/serve/runner.py

@@ -68,6 +68,9 @@ def _stream(self) -> None:
 
     def start(self) -> None:
         self._proc = subprocess.Popen(
+            # Command shape is fixed in spawn_run: sys.executable, module name,
+            # validated GitHub owner, and allowlisted flags; shell remains off.
+            # codeql[py/command-line-injection]
             self.cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,