ci: fix CodeQL action version comments

[wochinge]

Summary

• update both CodeQL action version comments from v3 to v4.35.2 to match the pinned SHA

Checks

• pre-commit hook ran: build, lint, typecheck, format:check, check:schema

[github-actions]

@claude review

[claude]

LGTM, comment-only fix to align version annotations with the pinned SHA.

Extended reasoning...

Overview

This PR updates only the trailing version comments on two pinned github/codeql-action step references (init and analyze) in .github/workflows/codeql.yml from # v3 to # v4.35.2. The SHA 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 remains unchanged.

Security risks

None. The pinned commit SHA is what GitHub Actions actually resolves; YAML comments are inert. There is no behavioral change to the CodeQL workflow.

Level of scrutiny

Minimal scrutiny is warranted. This is a pure documentation/annotation fix in a CI workflow, with no executable change.

Other factors

The bug hunting system found no issues. The change is self-contained, mechanical, and obvious.

[github-actions]

Experiment Results: 4bbd341

Experiment	Status	Actions
Uppercase (py)	✅ Pass	View GitHub Action Run · View in Langfuse
Uppercase (ts)	✅ Pass	View GitHub Action Run · View in Langfuse
Mixed dir (node)	✅ Pass	View GitHub Action Run · View in Langfuse
Mixed dir (python)	✅ Pass	View GitHub Action Run · View in Langfuse
Regression fixture	❌ Regression	View GitHub Action Run · View in Langfuse

Details

✅ Uppercase (py) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

✅ Uppercase (ts) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

✅ Mixed dir (node) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

✅ Mixed dir (python) (Source)

Score	Value
avg_accuracy	1.000

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000

❌ Regression fixture (Source)

RegressionError: synthetic regression triggered by e2e fixture

Item results (3)

Item	Input	Expected	Output	exact_match
1	langfuse	LANGFUSE	LANGFUSE	1.000
2	world	WORLD	WORLD	1.000
3	hello	HELLO	HELLO	1.000