style: automated autofixes from CodeQL workflow

[github-actions]

Automated cleanup pushed by the CodeQL Advanced workflow.

Tools applied:

• ruff check --fix + ruff format (unsafe fixes only enabled when allow_unsafe_fixes=true on scheduled/manual runs)
• prettier --write
• eslint --fix (if configured in the repository)
• clang-format -i --style=file (when C/C++ files are present)

Triggered by: schedule on refs/heads/main (run #30054706752).

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/dependabot-auto-label.yml::dependabot

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/ossar.yml::ossar-scan

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/dependabot-auto-merge.yml::dependabot

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/docs.yml::build-docs

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[bryan-roe-bot]

Semgrep identified an issue in your code:
Possibly found usage of AI: OpenAI

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detect-generic-ai-oai.

_{You can view more details about this finding in the Semgrep AppSec Platform.}