fix(ci): re-key codeql.yml lock entry to its bumped refs

codeql.yml was bumped to actions/checkout@v7.0.1 and
github/codeql-action@v4.38.2 but actions.lock still pinned v6.0.2 and
v4.34.0, so every CodeQL run since 5e75753 (2026-09-28) died at startup
with "Invalid lockfile". CodeQL is the ruleset's only required status
check, so no PR on main could merge.

Hand-edited (write mode de-pins SHAs and prunes shared records):
v4.38.2 -> 2892aa5e (annotated tag dereferenced), v7.0.1 -> 3d3c42e5.
gh actions-lock --no-fix: codeql.yml findings 10 -> 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SJGZgoR9ArMgxKcqG7ChW8

Author: hyperpolymath

.github/workflows/actions.lock

@@ -24,8 +24,8 @@ workflows:
         - 'actions/upload-artifact@v4.6.2'
         - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/codeql.yml':
-        - 'actions/checkout@v6.0.2'
-        - 'github/codeql-action@v4.34.0'
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.38.2'
     '.github/workflows/coverage.yml':
         - 'actions/checkout@v5.0.1'
         - 'dtolnay/rust-toolchain@v1'
@@ -102,6 +102,11 @@ dependencies:
         commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/configure-pages@v5.0.0':
         ref: 'v5.0.0'
         commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
@@ -144,9 +149,9 @@ dependencies:
         commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
         owner_id: 1940490
         repo_id: 260749683
-    'github/codeql-action@v4.34.0':
-        ref: 'v4.34.0'
-        commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
+    'github/codeql-action@v4.38.2':
+        ref: 'v4.38.2'
+        commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
         owner_id: 9919
         repo_id: 259445878
     'haskell-actions/setup@v2.7.5':