Update from task 7aa0e56a-060a-4ef2-b389-a141a6ee9fc7

.github/workflows/codeql.yml

@@ -75,7 +75,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      uses: github/codeql-action/init@47bee4ed195dc0a5f7b1c3e6911af57c2faba0ee # v5.37.6
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -104,6 +104,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3.35.2
+      uses: github/codeql-action/analyze@47bee4ed195dc0a5f7b1c3e6911af57c2faba0ee # v5.37.6
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/security.yml

@@ -95,13 +95,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@47bee4ed195dc0a5f7b1c3e6911af57c2faba0ee # v5.37.6
         with:
           languages: javascript-typescript
           build-mode: none
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3.35.2
+        uses: github/codeql-action/analyze@47bee4ed195dc0a5f7b1c3e6911af57c2faba0ee # v5.37.6
+        with:
+          category: "/language:javascript-typescript"
 
   gitleaks:
     name: Secret Scanning

.gitignore

@@ -1,18 +1,13 @@
+```
 # Logs and temp files
 *.log
 *.tmp
 *.swp
-lint_output.txt
-tsc_output.txt
-*.tsbuildinfo
-.turbo/
-playwright-report/
-test-results/
-.react-router/
-client/.react-router/
+
+# Environment
 .env
 .env.local
-*.env.*
+.env.*
 
 # Editors
 .vscode/
@@ -30,27 +25,30 @@ build/
 target/
 .gradle/
 
-# System files
+# OS generated files
 .DS_Store
 Thumbs.db
 
-# Compiled files
+# Python specific
 *.pyc
+*.pyo
+*.pyd
+.Python
+.coverage
+htmlcov/
+coverage/
+
+# Compiled files
 *.class
 *.o
+*.obj
 *.exe
 *.dll
 *.so
 *.a
-*.obj
 *.out
 
-# Coverage
-coverage/
-htmlcov/
-.coverage
-
-# Compressed files
+# Archives
 *.zip
 *.gz
 *.tar
@@ -73,57 +71,4 @@ htmlcov/
 *.tar.bz2
 *.tar.xz
 *.tar.zst
-
-# Compiled utility outputs
-utils/**/*.js
-utils/**/*.d.ts
-utils/**/*.d.ts.map
-
-# Legacy worktrees
-legacy/worktrees/
-
-# IDE/tool-specific
-.kilocodemodes
-.config/
-.context/
-.auth/
-
-# Protocol 0 session files (not project documentation)
-task_plan.md
-findings.md
-findings/
-
-# Log output directories
-logs/
-
-# One-off debug artifacts
-test-bind.ts
-shell_metadata.csv
-FULL_SYSTEM_CONTEXT.json
-
-# E2E visual regression snapshots (regenerable)
-tests/e2e/**/*.png
-e2e/__snapshots__/
-.gstack/
-.claude/skills/gstack/
-
-# Self-hosted GitHub Actions runner
-.github/runner/
-
-# Scratch directory for temporary scripts
-scratch/
-
-# Agent session artefacts (Phase 3 audit additions — 2026-07-08)
-.stryker-tmp/
-ORIGINAL_REQUEST.md
-knip.txt
-test-results.json
-test-e2e-output.log
-e2e-console-logs.txt
-full_test_output.txt
-test_output.txt
-server.log
-check.log
-# Added by code-review-graph
-.code-review-graph/
-.agents/
+```