chore(deps): refresh CodeQL and uv toolchain

[abrichr]

Summary

• Pin CodeQL Action init and analyze to the immutable v4.37.7 commit.
• Pin the release helper to uv 0.12.5 in the release extra and semantic-release build command.
• Regenerate uv.lock with exact uv 0.12.5 and update the release contract test.

Why

Tray main had valid intermediate updates to CodeQL Action 4.37.4 and uv 0.12.4. The official stable upstream versions are now CodeQL Action 4.37.7 and uv 0.12.5. This change completes that toolchain refresh in one bounded PR.

This is tooling-only. It does not change the Tray package version or runtime dependencies. The chore commit type must not create a package release.

Validation

• 235 tests passed; 2 skipped
• Ruff passed
• uv lock --check passed with exact uv 0.12.5
• wheel and sdist build passed
• source tree and built distributions passed the source-boundary check
• upstream action tag v4.37.7 resolves to commit ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd