fix(ci): regenerate actions.lock — workflow refs had drifted ahead of it (#108)

Workflows reference action versions this lockfile does not pin. Actions
were
bumped in the workflows and `gh actions-lock` was never re-run, so the
lockfile
still records the older ref — and lockfile enforcement rejects a
workflow whose
refs it cannot resolve, before any job starts.

Regenerated with `gh actions-lock` (v0.1.6) rather than hand-edited.
Every
entry needs a resolved commit SHA plus owner_id and repo_id, and
hand-authoring
those is exactly how the sibling defect happened — a caller entry
written into
the `dependencies:` map instead of `workflows:`, which made the whole
file
unparseable and killed every workflow in the repo at once.

Verified before pushing, three ways: the hand-authored reusable-caller
entries
survive the regeneration (checked by count, because the tool does not
generate
them and deleting them would re-break the repo); every key under
`dependencies:` still matches owner/repo@ref; and `gh actions-lock
--no-fix`
passes its own verification afterwards.

One of 26 repos of 52 carrying a lockfile — half the estate — found by
scanning
after metadatastician/688-attack-hub#18.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/actions.lock

@@ -5,7 +5,7 @@ version: 'v0.0.2'
 workflows:
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.37.4'
+        - 'github/codeql-action@v4.37.5'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/instant-sync.yml':
@@ -47,9 +47,9 @@ dependencies:
         commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
         owner_id: 9713907
         repo_id: 222439721
-    'github/codeql-action@v4.37.4':
-        ref: 'v4.37.4'
-        commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
+    'github/codeql-action@v4.37.5':
+        ref: 'v4.37.5'
+        commit: 'sha1-d1ba80a13dd99fba24a470575428917156a28b43'
         owner_id: 9919
         repo_id: 259445878
     'peter-evans/repository-dispatch@v4.0.1':