chore(ci): CodeQL pin comment v3.28.1 -> v3 (SHA unchanged)

[hyperpolymath]

Pushes a commit that was stranded on a local checkout (5b3f68b).

What this actually changes

Nothing functional. Despite the original commit message ("update CodeQL
actions to SHA-pinned v3 (29b1f65c)"), the diff leaves the pinned SHA
unchanged at 7188fc363630916deb702c7fdcf4e481b751f97a for both
codeql-action/init and codeql-action/analyze.

The only change is the trailing comment:

-  uses: github/codeql-action/init@7188fc36...  # v3.28.1
+  uses: github/codeql-action/init@7188fc36...  # v3

The SHA 29b1f65c referenced in the commit message does not appear in the diff.

Reviewer decision needed

This arguably makes the pin less informative — # v3.28.1 names the exact
release, # v3 does not. Options:

1. Close this and drop the commit (CodeQL is currently green on main).
2. Merge as-is for comment consistency with the rest of the estate.
3. Amend it to genuinely re-pin onto the intended 29b1f65c, if that is the
   current codeql-action v3 SHA — this needs confirming, not guessing.

Opened as a draft because of the above. Raised during the BetLang sitrep;
see dev-notes/betlang-sitrep-2026-07-27.md.

🤖 Generated with Claude Code