chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.1

[dependabot]

Summary

• Bump github/codeql-action/analyze from 4.37.0 to 4.37.1.

Governing Issue

No governing issue is linked: this is a Dependabot-managed patch dependency update tracked by this PR.

Validation

• Existing Fast Checks passed for head 9ada5f7b388215273a3107fa220f11f95864862f (run 29833282045).
• This PR description repair is validated by the required PR Fast CI rerun.
• Agent-authored changes passed autoreview against the intended PR diff with no accepted/actionable findings (not applicable: no repository diff was authored).
• Required PR checks are expected to satisfy CI Gate.
• No local checks were run because this repair changes PR metadata only.

Bootstrap Governance

• Changes are scoped to this Dependabot patch dependency update.
• Contributor or PR guidance files are not changed.
• Auto-merge is unavailable because Dependabot is the PR author and cannot perform maintainer merge configuration; the fallback merge-readiness policy applies after required checks are green and an independent approval is present.
• No repository files or secrets were changed.

Material change: no
ADR: not applicable

Merge Automation

• Auto-merge is unavailable because Dependabot is the PR author; fallback merge-readiness applies.

Notes

• PR metadata-only repair requested by review; the Dependabot-authored commit and branch are unchanged.

[athena-omt]

Reviewed the current head. The immutable CodeQL analyze v4.37.1 pin is valid and the action-pin check passes. However, required PR Fast CI fails because the Dependabot PR body lacks the repository-required governance sections, governing-issue statement, validation evidence, and auto-merge status; its CI Gate consequently fails. Please update the PR body to satisfy the template (or add an explicit Dependabot exemption if that is the intended policy) and rerun CI before merge.

[athena-omt]

Request changes. The CodeQL analyze v4.37.1 immutable pin is valid, but the follow-up commit introduces an unscoped governance bypass: .github/workflows/pr-fast-ci.yml skips both PR-description and PR-governance validation for every Dependabot-authored PR, while CI Gate explicitly accepts skipped jobs. This removes the required metadata and governance evidence for all Dependabot PRs.

Additionally, this workflow is generated from src/archetypes.ts; that canonical source and tests/render.test.ts were not updated. The exemption therefore is not reproducible for generated repositories and can be overwritten by regeneration.

Please revert the bypass, or implement a policy-approved, narrowly scoped exemption in src/archetypes.ts, add coverage for its intended behavior, regenerate the checked-in workflow, and rerun the targeted render/CI checks.