Security audit: SHA-pin CodeQL actions, sync server.json version

[Sourav-Nandy-ai]

Summary

• SHA-pin codeql.yml's actions/checkout and github/codeql-action/{init,autobuild,analyze} steps (previously mutable @v4/@v3 tags) to immutable commit SHAs, matching the pinning convention already used in ci.yml and the publish workflows.
• Bump python/server.json's version fields from 0.1.3 to 0.1.4 to match the actual current PyPI release of computeledger-cli.

Investigation: TS run subcommand smoke-test hang on Windows

Reproduced locally on Windows and confirmed this is not a defect in run.ts. Every cli.smoke.test.ts test that shells out to the built CLI via execFileSync — not just the tests exercising the run subcommand — exceeds vitest's default 5000ms per-test timeout purely from per-process node.exe spawn overhead on this machine. With a generous timeout override (--testTimeout=45000), all 11 smoke tests, including all three run tests, pass cleanly with no hang. ci.yml only targets ubuntu-latest, so this never surfaces in actual CI. No source change was made for this finding, per instructions not to force a fix for a confirmed environment-only quirk.

Test plan

• npx vitest run (default settings, Windows): 25 passed / 11 failed of 36 — all 11 failures are either the known Windows path-separator assumption in src/config.test.ts (2) or cli.smoke.test.ts per-test timeouts from Windows process-spawn overhead (9), none new or caused by this change.
• npx vitest run src/cli.smoke.test.ts --testTimeout=45000 (Windows): 11/11 passed, confirming no genuine hang, including all three run subcommand tests.
• pytest via the project's own .venv (Windows): 63 passed / 3 failed of 66 — all 3 failures are pre-existing Windows-specific causes (2 path-separator assumptions in test_config.py, 1 POSIX file-mode 0o600 assumption in test_crypto.py), unrelated to this change.
• Confirmed no other stale version references remain in-repo (checked package.json, package-lock.json, pyproject.toml, Python fallback version constants).

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01QyJoCc6YtjnErv6HKa6NPu