ci: fix Dependabot updates and stabilize the Grok cleanup test

[dependabot]

Dependabot split the CodeQL init and analyze updates into separate PRs. Each mixed versions 4.37.3 and 4.37.9 and failed while loading the analysis configuration. Both steps now use the same pinned 4.37.9 commit, and github/codeql-action/* updates are grouped to keep them together in future PRs.

This also updates actions/upload-artifact from 4.6.2 to 7.0.1. It supersedes the changes proposed in #71 and #72.

An additional CI run exposed a race in the Grok process-cleanup test. The fake CLI now installs its termination handler before publishing readiness, and the assertion waits up to one second for terminated descendants to be reaped, matching the existing app-exit check. The production cleanup implementation is unchanged.

Validation:

• Workflow and Dependabot YAML parsed successfully; both CodeQL steps reference the same commit.
• A macOS GitHub Actions job uploaded the published 0.3.0 app archive and feed plus a Markdown file with v7.0.1. All three downloaded files retained the expected names, layout, and exact contents; archive and feed SHA-256 digests matched the published assets. Evidence: https://github.com/thrr87/codex-limits/actions/runs/34520697363
• The temporary compatibility job was removed; the final diff contains the dependency updates, CodeQL grouping, and the cleanup-test synchronization fix.
• All seven Grok billing tests pass locally, including 30 consecutive repetitions of the cleanup test. The full Release test bundle passes all 644 tests. Final commit bba097d passed Swift CI and both CodeQL analyses before merge: https://github.com/thrr87/codex-limits/actions/runs/34522758912 and https://github.com/thrr87/codex-limits/actions/runs/34522758920.