ci: review-pin codeql-action v4.37.9 and setup-buildx-action v4.3.0

[sumitake]

Companion for Dependabot GitHub Actions bumps. check_workflow_policy.py rejects Dependabot-only SHA edits unless REVIEWED_ACTION_PINS and the trailing # <release> comments move in the same change.

Verified against upstream tags:

• github/codeql-action v4.37.9^{} → cdf488f595d80d6e07e03d4674febd5ab45fa938 (init, autobuild, and analyze stay on the same SHA)
• docker/setup-buildx-action v4.3.0 / v4 → 37fe631027851001ddb9b187196cc803df7f5f0e

Dependabot #46's container job already passed with the v4.3.0 pin, so this is not an untested major.

After merge, close sumitake/GitHub-ActionRunner#45 and #46 as superseded.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e859177-09e3-4a1e-b10b-b7cb9be6dfcf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T07:39:37.809406Z	f00d7e0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.