develop is green again: a held driver and a verified pin

[sridharkalaibala]

develop has been red since #749 merged, and every branch cut from it inherits
the failure - which is why #745 came back red after its conflict was resolved.

Neither of these is a code fix. Both are decisions the automation is not allowed
to make on its own, and in one case the guard that stopped it was working
exactly as intended.

1. Mongoose 9.10 cannot talk to the test database

#749 moved mongoose 9.9.5 → 9.10.0 inside a patch-and-minor group. Mongoose
9.10 moves its bundled mongodb driver from ~7.5 to ~7.6, and the handshake
7.6 sends is rejected outright by the mongod mongodb-memory-server runs:

MongooseServerSelectionError: Missing required sub-document 'driver'
in the client metadata document
    at Object.<anonymous> (tests/.../the-bill-flow-end-to-end.test.js:39:3)

Line 39 is await mongoose.connect(...). It is not a test that broke, it is the
connection - every suite that opens a database died in beforeAll, which is why
six unrelated files failed at once and each took ~30s to give up.

Reproduced locally rather than guessed: installed 9.10.1 against mongod 8.2.6,
got the identical error, went back to 9.9.5, clean.

Held at ~9.9.5, which still accepts patches. Dependabot is told the range and
the reason, so it does not reopen the same pull request on Monday, and the note
says how to lift it: run the api suite against 9.10 or later, and if it connects,
widen back to a caret.

2. The codeql pin was never approved, and that guard worked

#750 bumped github/codeql-action/upload-sarif to v4.38.0. The workflow carries
the new SHA; tests/scorecard-workflow.test.js carries the SHAs a person has
actually verified, and nobody had verified this one.

That is the supply-chain guard doing its job. A bump arrives as a SHA plus a
trailing comment, and the comment is written by whoever opened the pull request,
not by the registry - so the test refuses to take the comment's word for it.

Verified upstream before approving, the way the existing comment instructs:

gh api repos/github/codeql-action/git/ref/tags/v4.38.0
  -> annotated tag 4bd7200e1f146b1c937cae12d258b50f41a53cf8
gh api repos/github/codeql-action/git/tags/4bd7200e...
  -> commit      b96794f015dfd88f77b49b1c93e0fa7110f94c63

which is exactly the commit the workflow now pins, so the bump is genuine and is
approved here. The new comment records the commands and the trap worth
remembering: a signed release's refs/tags/vX points at a tag object, so
reading .object.sha off the ref approves the tag rather than the commit it
names.

Tests

API 10625 pass / 0 fail. Desktop 2427 pass / 0 fail.

Merge this first

It unblocks everything else. Once develop is green:

#751 (this)  →  #744  →  #746  →  #747  →  #745

#745 and #747 both append to all seventeen language packs, so whichever goes
second needs a resolve; #744 and #746 touch no packs.

[github-actions]

Merged to develop. Anyone can test this - you do not need write access.

Try it at https://develop.posnic.io, or run it yourself:

git fetch origin develop && git checkout develop
npm install && npm --prefix api install
npm run dev   # then http://localhost:3000

When you have tested it, say what you did and what happened, and set
QA passed or QA failed. If you cannot set labels, just comment -
a maintainer will.

Reporting that something is broken is as useful as fixing it. It is
better found here than by a shopkeeper.