fix(governance): bootstrap CodeQL and Strix security gates

[seonghobae]

Protected-check bootstrap

The current default branch has two independent defects that form a merge deadlock:

1. codeql-pr.yml and scheduled-security-scan.yml mix CodeQL Action 4.37.0 and 4.37.4, so the existing one-version-per-workflow contract fails during central coverage evidence;
2. the governed Strix CI lock contains vulnerable aiohttp==3.14.1 and cryptography==49.0.0, so Python Security fails even for otherwise clean workflow-only pull requests.

A workflow-only PR cannot pass Python Security, while dependency/resolver PRs cannot receive clean central review evidence from the inconsistent CodeQL base. This PR is the minimal four-file bootstrap that fixes both causes without suppressing either gate.

Change

• pin all CodeQL init, analyze, and upload-sarif steps in the two canonical workflows to immutable v4.37.4;
• refresh the hash-locked Strix environment to resolve aiohttp==3.14.3 and cryptography==50.0.0 while preserving the existing direct dependency surface and protobuf<7 compatibility;
• preserve permissions, SARIF fail-closed behavior, severity thresholds, and hash-required installation;
• add no temporary workflow or protection exception.

Verification basis

The identical four-file tree at commit 54aa21b59c6c2cba28c7c2289ced62005b4b5906 completed CodeQL, Python Security, Security Scan, Semgrep, Secret Scan, OSV, Scorecard, and SBOM successfully. This new branch rebases exactly that verified tree onto current main as one commit, 77522a050383369187dfb5ecac055036c678e47d.

Current-head checks and independent approval remain mandatory before merge. After this bootstrap, the npm-workspace resolver PR can be rebuilt against the corrected base and the obsolete duplicate CodeQL PRs remain closed.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 47ad76c2-47d1-4103-b9f2-b5af61a903f8

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 77522a0.

📒 Files selected for processing (4)

• .github/workflows/codeql-pr.yml
• .github/workflows/scheduled-security-scan.yml
• requirements-strix-ci-hashes.txt
• requirements-strix-ci.txt

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact bootstrap head 77522a050383369187dfb5ecac055036c678e47d. It is one commit from current main, changes exactly four governed files, and reproduces the already direct-check-green tree without temporary automation or gate suppression.

[coderabbitai]

@seonghobae I will review pull request #730 at commit 77522a050383369187dfb5ecac055036c678e47d.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Superseded by #731, which contains the identical four-file CodeQL/Strix baseline repair plus the fail-closed stale protected-base pin classifier needed to unblock dependency-upgrade PR coverage. Closing this narrower duplicate avoids duplicate required-check load; #731 remains subject to exact-head checks and independent review.