chore(ci): bump codeql-action init and analyze to v4.38.2

[stevenobiajulu]

Bumps github/codeql-action/init and /analyze together, to 2892aa5e (v4.38.2, the annotated tag dereferenced). The same pattern as #1134.

Dependabot's split PRs #901 (analyze) and #902 (init) each bump only one of the pair, and CI fails on the version mismatch. This PR makes both unnecessary; dependabot should close them once this merges.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
site	Ready	Preview	Oct 2, 2026 9:11pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T21:12:40.635321Z	a4e89f6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[usejunior-llm-gate]

LLM gate (advisory)

All evaluated rules passed - 3 pass, 0 warn, 0 error, 13 skipped, 16 total

Findings

None.

All 16 rules (3 evaluated, 13 skipped)

Rule	Verdict	Detail
read_file response metadata parity	SKIPPED	paths not touched by this PR
Live DOM namespace-safe OOXML writes	SKIPPED	paths not touched by this PR
Complex-field revisions preserve complete accept/reject state machines	PASS	The PR only modifies CodeQL action versions in .github/workflows/ci.yml and does not touch field atomization, validateFieldStructure, or complex-field revisions.
Field validation per story, not global	SKIPPED	paths not touched by this PR
Revision IDs seeded from all revision-bearing side parts	SKIPPED	paths not touched by this PR
Accept/reject sweep side parts and caches	PASS	The PR only modifies CodeQL action versions in .github/workflows/ci.yml and does not touch accept/reject changes or side-part revision markup.
DocumentViewNode.heading stays canonical	SKIPPED	paths not touched by this PR
AI-author parity across entry points	SKIPPED	paths not touched by this PR
Property-change wrapper discipline	SKIPPED	paths not touched by this PR
SUPPORT.md Table A drift vs. implementation	SKIPPED	paths not touched by this PR
Table A / Table B boundary on side-part revisions	SKIPPED	paths not touched by this PR
Canonical-emission surface completeness	SKIPPED	paths not touched by this PR
Unit-test quality (avoid tautological / change-detector tests)	SKIPPED	paths not touched by this PR
Re-derived facts vs canonical sources	PASS	The PR only updates GitHub Action SHAs in .github/workflows/ci.yml and does not add or modify any codebase logic, so the precondition for re-derived facts is not met.
.openspec tag ↔ test-assertion drift	SKIPPED	paths not touched by this PR
Library stays general (no downstream-domain leakage)	SKIPPED	paths not touched by this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!