[hideouts-io]

Separate CodeQL action updates can leave init and analyze on different versions, causing the configuration mismatch seen in #32 and #33.

Update both actions together to the verified full v4.39.1 commit and group github/codeql-action/* dependencies in Dependabot so future subpath updates stay coordinated. Existing workflow triggers, permissions, runner, timeout, language, and analysis category are preserved. No application code or dependency versions change.

Validation at head 50b2cf6d22306aff44e28a99c676da89186899a7:

• Tests: 205 tests, command catalog, CLI/compile checks, 186 GUI actions and 64 layouts passed.
• Analyze Python: passed with both action steps on v4.39.1; 43 rules and zero results. This used overlay extraction with baseline reuse, not a fresh extraction of every Python file.
• Dependency review: passed.
• Independent two-file diff review, YAML semantic comparison, upstream commit verification, and git diff --check passed. Documentation and frozen-build workflows were excluded by their existing path filters.

The hosted workflows checked test-merge b61d63f2e617a81a3b30012dd3ed71bbe9af6607, whose parents are the exact base and PR head.