ci: bump github/codeql-action to Node 24 once a build exists (fleet-wide blocker)

[asachs01]

Background

The Node 20 GitHub Actions runtime is deprecated — forced onto Node 24 on 2026-06-16, removed from runners on 2026-09-16 (changelog).

PR #24 bumped every in-repo action that had a Node 24 build, and those reusable workflows were then re-pinned across all ~45 consumer *-mcp repos. One action could not be bumped:

• github/codeql-action/upload-sarif in .github/workflows/mcp-server-release.yml (the Trivy SARIF upload step). Even the latest v3 still declares runs.using: node20; GitHub has not shipped a Node 24 build yet.

Because this lives in the shared mcp-server-release.yml, it affects the release pipeline of every consumer repo that pins it.

Action

• When github/codeql-action ships a Node 24 build (expected as a future v4), bump the SHA pin in mcp-server-release.yml and re-roll the pin across consumers (same process as the 2026-06-15 rollout).

Current pin

github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.35.3

Notes

• Safe to defer until before 2026-09-16 (warnings only until then).
• Per-repo equivalent already tracked in autotask-mcp#176.