ci: synchronize CodeQL action versions - #62

❌ PatchGate Snapshot Rejected

Diagnostic: GITHUB_PROVENANCE_AMBIGUOUS
Message: Native ruleset or branch-protection visibility is incomplete; the current evaluator cannot safely treat unknown native controls as absent.
Remediation: Grant the documented native-control read permissions and rerun, or keep the native-control snapshot rejected.