[Lojhan]

Summary

• replace potentially expensive compiler and MySQL regex parsing with linear scanners
• tighten language-server and VS Code qualifier matching for all reported CodeQL locations
• add adversarial Poku regression tests and a fail-closed high-severity CodeQL release gate
• update SHA-pinned checkout to 7.0.1, setup-node to 7.0.0, and dependency-review-action to 5.0.0
• group future GitHub Actions Dependabot updates and advance the stable-release plan

Supersedes #4, #5, and #6.

Verification

• pnpm verify on Node 24.10.0
• pnpm audit --prod --audit-level high
• targeted compiler, MySQL, language-server, and contract Poku suites

[Lojhan]

Superseded by #12, which has the identical verified tree in a GitHub-signed commit and therefore satisfies the protected branch signature policy.