Update Setup Java and CodeQL action pins

[dependabot]

Change

Update all eight Setup Java call sites from v6.0.1 to v6.1.0 and both CodeQL subactions from v4.38.3 to v4.39.0, retaining full commit pins. Refresh ACTION_PINS.md and CI_SECURITY.md with matching versions, the dereferenced CodeQL tag object and scoped source-review notes.

The authoritative Setup Java v6.1.0 ref resolves directly to b843ebf9b913146b38da2eaa7aeddf76074ae1ad. CodeQL v4.39.0 tag object 48870fdd6b42ee6474ec4207209ff87609271a5e resolves to 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee.

Source comparisons: Setup Java, CodeQL.

Compatibility and validation

Final reviewed integration revision: 393ba22e54a8ba7cae8aad14e6b15e035e6fc214. The initial source review covered 57ddbeb1d254a31b8e402703b8b1a42b003512bc; the final revision incorporates merged PR #253.

The new Maven credential-origin and repository inputs are unused. Existing checkout paths satisfy CodeQL's new validation; final CI logs confirm CodeQL 2.27.2, above the new 2.20.7 minimum. Permissions, credential persistence, Maven cache isolation, action allowlist, required gates and Java runtime baselines remain unchanged.

• actionlint, 36 Python policy tests, 17 packaged-artifact guard tests and git diff --check passed.
• JDK 17 / committed Maven wrapper clean reactor verify passed.
• Final-revision hosted Java CI gate, Packaged consumer gate, and Java/Actions/Python CodeQL checks passed. Hosted CI covers the Docker/browser fixture, original-JAR consumers on Java 8/11/17/21/25, Java 8 unit tests and Windows/Linux wrapper checks.
• Verified upstream release-to-commit mappings, relevant source changes and dependency/download behavior. This is a focused update review, not a full audit or a reproducible-build attestation of bundled JavaScript.

No library behavior or consumer migration changes.

Model-assisted review

Applied MODELS.md as a focused dependency/workflow review on the revision above:

Slot	Actual model/tool	Final recommendation
Build and resolution	gpt-6-astra, Codex delegated agent	MERGE
Second build	claude-opus-5-5, Claude Code 2.1.302	MERGE
Independent correctness	gpt-6.1-sol, Codex delegated agent	MERGE
Independent security	gpt-daybreak-blue-latest, Codex CLI 0.163.0, explicit daybreak_blue	MERGE
Independent security	claude-mythos-5-1, Claude Code 2.1.302	MERGE
Independent documentation	claude-sonnet-5-5, Claude Code 2.1.302	MERGE

The authenticated Codex catalog advertised the exact Daybreak Blue picker alias and daybreakBlue access; the explicit empty-directory probe completed READY, followed by actual review. The underlying backend identity was not exposed and is not claimed. No fallback option was enabled. Claude Code reported additional claude-haiku-5-5 usage during the first Mythos run without identifying its role; the final confirmation reported only claude-mythos-5-1.

Accepted findings: refresh the stale action inventory, CodeQL annotated-tag object and CI version reference. The revised files resolved them. An additional inventory-policy test was suggested but is not required to validate these pins and was deferred. The default-bundle documentation was corroborated by final CI logs showing CodeQL 2.27.2.

Reviewers submitted their independent conclusions before seeing other reviewers' results; the documentation correction received final-revision review. Initial final packet SHA-256: 24ef171c9990d29531f6d822026e11a31354b2ff4597b40ff1a23779448bd956.

After PR #253 merged, all six named models completed focused integration reviews of 393ba22e54a8ba7cae8aad14e6b15e035e6fc214 and recommended MERGE subject to fresh required CI. The entire PR patch is byte-identical to the reviewed patch; the six Actions PR file blobs are unchanged, and the only integrated files (pom.xml and RELEASING.md) match reviewed PR #253 exactly. No conflict-resolution edits or integration findings arose. Integration packet SHA-256: 2b5e3f72084f5865ac021e6c6efd60801d5f58fc034f225d7abdecc5146124d8.

The Daybreak integration review passed 11 focused policy tests; six additional reviewer-local tests could not run in its read-only temporary-directory sandbox. Required hosted CI remains authoritative for the complete policy suite. These are advisory AI reviews, not independent maintainer approval. The operator explicitly authorized the existing named-maintainer PR-only review bypass; no CI check or ruleset may be bypassed or weakened.

Disposition

Merged on 2026-10-20 as 57692db370cb070609baaf20399a82cf6a53b56a, after all five required checks passed on final integration revision 393ba22e54a8ba7cae8aad14e6b15e035e6fc214. Used the operator-authorized existing PR-only review bypass. No AI-generated human approval was submitted, no CI check was bypassed, and no ruleset was changed.

• I kept the change scoped and preserved relevant notices.
• I checked documentation/changelog and tests for any behavior change.
• This PR contains no credentials or private vulnerability evidence.