Unpinned/deprecated codeql-action references in emitted CI YAML and tutorials

PR #3533 pinned all in-repo CI uses of `github/codeql-action` to the v4.37.3 SHA, but a consistency sweep found user-facing references that still use floating and/or deprecated majors:

- `agent-governance-typescript/agent-os-vscode/src/enterprise/integration/cicdIntegration.ts:72` — the generated CI YAML emitted for users contains unpinned `github/codeql-action/upload-sarif@v3` (deprecated major, floating tag).
- `docs/tutorials/25-security-hardening.md:236,239,359` — shows unpinned `@v3`/`@v2` codeql-action steps in a security-hardening tutorial.
- `agent-governance-python/agent-os/docs/tutorials/vscode-extension.md:517` — same pattern.

A governance toolkit telling users to consume actions via floating deprecated tags undercuts the supply-chain guidance the repo itself follows (Scorecard pinned-dependencies). Suggested fix: update the emitted YAML and tutorial snippets to `github/codeql-action/<sub>@ # v4.x.y` (or at minimum a current major with a note about SHA-pinning), and consider a lint/test that greps emitted templates and docs for unpinned `uses:` of security-relevant actions.</sub>

Line numbers as of main at the time of filing; found while reviewing #3533.

Inspect agent-governance-typescript/agent-os-vscode/src/enterprise/integration/cicdIntegration.ts:72 and the listed lines in docs/tutorials/25-security-hardening.md and agent-governance-python/agent-os/docs/tutorials/vscode-extension.md. Search these emitted YAML and tutorial snippets for github/codeql-action uses, then update them to the pinned SHA format used by PR #3533 and verify no unpinned deprecated references remain.

Written by the indexing model from the issue text.