fix(ci): pin codeql-action to the v4.38.0 SHA and resync actions.lock — un-startup-kill CI

[arena-ai-coding-agent]

Summary

Follow-up to #106. That PR landed the #102 conflict resolution but inherited Dependabot #105's broken state: github/codeql-action bumped to v4.38.1, a version under an estate-wide hold because GitHub's workflow-startup validation rejects it — any workflow naming it dies at startup with zero jobs (hyperpolymath/nexia-list#100, hyperpolymath/standards#973/#978). This is what caused the startup_failures observed while #106 was being verified, and it is still killing Coverage, OikosBot, and reddening Governance / Actions lockfile verify + Lock Sync Gate on main.

Changes

• codeql.yml (init/analyze) and oikosbot.yml (upload-sarif): pinned to the v4.38.0 SHA b96794f per the estate rollback precedent; persist-credentials: false retained.
• .github/dependabot.yml: full hold on github/codeql-action until upstream clears 4.38.1 or a newer release verifies green (the estate measured that a versions: ["4.38.1"] rule gets bypassed when dependabot re-raises in SHA form).
• actions.lock resynced to the workflow YAML (all four check-lock-sync.sh clauses):
  • codeql/oikosbot entries → v4.38.0 SHA form with a matching dependencies: record
  • plain drift closed: codecov-action v7.1.0 → v7.1.1 (303a32d, nested github-script use re-verified upstream) and taiki-e/install-action v2.87.13 → v2.87.17 (94c31af, no nested uses)
  • pruned the stale slsa-github-generator chain retired by the fix(release): build, package and ship the actual product #91 release rewrite

Testing

• Faithful local port of scripts/check-lock-sync.sh: all clauses pass (locked incl. job-level reusable refs, no orphans, transitively closed with 0 dangling edges, full coverage).
• Every workflow + lockfile + dependabot.yml parses as YAML.
• Workflow Security Linter steps (SPDX headers, permissions) pass locally.
• Zero references to v4.38.1/1c5b675 outside hold comments.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4c210abe-3d52-48d0-a842-77685fe3db52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}