fix(ci): pin codeql-action with exact version comment

[jdx]

Summary

• Update the # v4 comments on the three github/codeql-action/* SHA pins in codeql-analysis.yml to # v4.35.4, matching what the pinned SHA actually resolves to.
• Resolves the three ref-version-mismatch medium findings that are currently failing the zizmor check on every PR.

Test plan

• zizmor workflow passes on this branch
• CodeQL workflow still runs (no behavior change — same SHA pinned, only the comment changed)

🤖 Generated with Claude Code

---

Note

Low Risk
Comment-only change in CI workflow; the CodeQL action SHA pins are unchanged so runtime behavior should not change.

Overview
Updates .github/workflows/codeql-analysis.yml to change the inline version comments on the pinned github/codeql-action steps (init, autobuild, analyze) from # v4 to # v4.35.4, matching the existing pinned SHA and avoiding version-mismatch lint findings.

^{Reviewed by Cursor Bugbot for commit e3a6003. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[greptile-apps]

Greptile Summary

This PR updates the version comments on the three github/codeql-action SHA-pinned steps in codeql-analysis.yml from the vague # v4 to the precise # v4.35.4. No SHA values are changed; the pinned commit 68bde559dea0fdcac2102bfdf6230c5f70eb485e is confirmed to correspond to v4.35.4, making the comments accurate.

• Updates # v4 → # v4.35.4 on codeql-action/init, codeql-action/autobuild, and codeql-action/analyze steps, resolving three ref-version-mismatch findings from the zizmor security scanner.
• No runtime behavior change — same SHA, same action versions, only the inline comment is more specific.

Confidence Score: 5/5

Safe to merge — the change is comment-only with no runtime impact.

All three SHA pins are unchanged and confirmed to match v4.35.4; the only modification is the inline annotation becoming more specific. There is no logic, configuration, or permission change of any kind.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/codeql-analysis.yml	Comment-only update: three # v4 version annotations updated to # v4.35.4 on pinned SHA references; SHA itself is unchanged and confirmed to match v4.35.4.

_{Reviews (1): Last reviewed commit: "fix(ci): pin codeql-action with exact ve..." | Re-trigger Greptile}