chore(deps): update CodeQL action to 4.37.9 atomically

[AetherAI3]

Summary

• update both github/codeql-action/init and github/codeql-action/analyze from v4.37.8 to v4.37.9
• pin both components to the same immutable upstream commit: cdf488f595d80d6e07e03d4674febd5ab45fa938
• replace split Dependabot PRs chore(deps): bump github/codeql-action/analyze from 4.37.8 to 4.37.9 #126 and chore(deps): bump github/codeql-action/init from 4.37.8 to 4.37.9 #127, which each produce an invalid mixed-version CodeQL workflow

Safety

• the upstream commit is verified by GitHub and is the commit targeted by the v4.37.9 tag
• this changes exactly two uses: pins in .github/workflows/codeql.yml
• no runtime, permissions, trigger, release, or production behavior changes
• the official v4.37.9 release updates the default CodeQL bundle to 2.26.4

Evidence

The existing split PRs fail deterministically:

• chore(deps): bump github/codeql-action/analyze from 4.37.8 to 4.37.9 #126 initializes with 4.37.8 and analyzes with 4.37.9
• chore(deps): bump github/codeql-action/init from 4.37.8 to 4.37.9 #127 initializes with 4.37.9 and analyzes with 4.37.8
• both logs report a loaded-configuration/running-version mismatch

This replacement is based on current main (229e7c6170a3b2453daaa436868bd605486eba65) and updates both steps atomically.

Validation

• git diff --check
• exact-head hosted CI and CodeQL required before merge
• independent review required before merge

Supersedes #126 and #127.