chore: release v1.4.37

[mfreeman451]

Summary

Cut v1.4.37 from current staging after farm01 ran sha-32e160cbaf496b7ca02ec2d5a5c56d5dab4b8191 (3795 + 3797).

• nist-nvd2 staging budget/reaper and Software-tab match index (PR fix(core): stop nist-nvd2 extracts from filling the node #3795)
• Falco Critical is Error, 24h log-severity CAGG force-refill, cowlib 43971 waiver (PR fix(observability): stop Falco Critical from filling the Fatal card #3797)
• SRQL fixture CA unpublished from the shared gateway (PR fix(k8s): unpublish the SRQL fixture CA from the shared gateway #3799)

Merge with a merge commit (gh pr merge --merge). Squash/rebase would discard the tagged commit v1.4.37 (86d224c905).

The annotated tag is local only until that merge is on staging, then:

git fetch origin refs/heads/staging:refs/remotes/origin/staging
git merge-base --is-ancestor 'v1.4.37^{commit}' refs/remotes/origin/staging && \
  git push origin refs/tags/v1.4.37:refs/tags/v1.4.37

Test plan

• make test — 147/147 pass
• no duplicate Ecto migration versions
• MIX_ENV=prod mix release for serviceradar_core (no duplicated modules)
• farm01 helm rev 77 on sha-32e160cbaf…; all pods Ready; nist-nvd2 keep=1; migrations 20260818180000 + 20260818220000 applied
• merge-commit this PR, then publish the tag so the release workflow can publish artifacts and advance demo/prod-release

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[mfreeman451]

lgtm