[rhein1]

Updating only one CodeQL step leaves init and analyze on incompatible versions. PR #509 reproduces this with init 4.39.0 and analyze 4.38.2 (failed run).

Update both actions together in .github/workflows/codeql.yml to v4.39.0, pinned to immutable commit 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee. This combines the narrowly scoped changes proposed separately in #509 and #510; both existing PRs are left open and their branches are untouched.

Only the two action refs and version comments change. Triggers, permissions, language matrix, checkout, build mode, CodeQL configuration, security queries and analysis category are preserved.

Validation:

• Parsed YAML with duplicate-key rejection; exact two-line diff and normalized semantic equality passed.
• Independent source review and remote commit/file read-back passed.
• Verified the upstream v4.39.0 release and annotated tag resolve to the pinned commit. Both actions use Node 24; the existing workflow uses ubuntu-latest and the default CodeQL bundle.
• Local full repository tests were not run: local Git networking is unavailable. No software or credentials were installed.
• Hosted CI inspected on exact head 76377577b4a95518ad72d66d2cf92d10a21c8c01: 6 checks passed, 2 failed, 0 pending/not-run checks.
  • CodeQL passed both JavaScript/TypeScript and Python analysis; the CodeQL app check also passed with no new alerts in changed code.
  • Python SDK 3.8/3.14 and payment-contracts passed.
  • validate failed at the unchanged OpenRouter top60 dependency audit: pinned Zod 4.4.3 is affected by high-severity GHSA-mrhx-c7xc-m3w5 (<4.6.6).
  • adapter-conformance failed at the unchanged Claude SDK dependency audit: 6 vulnerabilities (2 moderate, 4 high), including the existing MCP SDK 1.31.0 override and transitive dependencies.
  • The validation run reports 47 skipped steps (45 later validation steps and two adapter post-setup cleanup steps). Commands after the failed audits, including Claude typecheck/test/test:cli, did not run. No audits were suppressed and no dependency changes are included.

No merge, deployment, package publication, payment operation, credential change or repository security-setting change is part of this PR.