fix: address release and dependency queue

[avifenesh]

Summary

• advance all eight open tool-release baselines after reviewing the current upstream releases
• match Cline's UTF-8 BOM behavior for rules, workflows, and skill frontmatter
• roll up the ten open dependency/action updates, including a consistent CodeQL v4.37.1 pin across init, analyze, and SARIF upload
• remove the resolved deprecated transitive serde_yaml tracking item

Closes #1217
Closes #1218
Closes #1219
Closes #1220
Closes #1221
Closes #1222
Closes #1223
Closes #1234

Supersedes #1224, #1225, #1226, #1227, #1228, #1229, #1230, #1231, #1232, and #1233.

Root causes

Cline now accepts BOM-prefixed frontmatter, while agnix's Cline-specific and shared frontmatter parsers treated the BOM as content and silently missed the opening delimiter. The standalone CodeQL analyze bump also mixed v4.37.1 with a v4.37.0 init step, which GitHub rejects at runtime.

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo run -p agnix-cli --bin agnix -- eval tests/eval.yaml
• cargo test -p agnix-cli --test kiro_ci_gate -- --include-ignored
• cargo test -p agnix-cli --test docs_website_parity
• cargo test --test security_hygiene
• node scripts/sync-rule-bookkeeping.js --check --skip-docs
• python3 scripts/check-rule-counts.py
• cargo audit --ignore RUSTSEC-2025-0141 --ignore RUSTSEC-2026-0173
• cargo deny check all

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gemini-code-assist]

Code Review

This pull request updates the baseline versions for several tracked tools and updates various Rust dependencies, including removing the deprecated serde_yaml package. It also adds support for parsing UTF-8 BOM-prefixed frontmatter and content in Cline rules and schemas, with corresponding test coverage. No review comments were provided, so there is no feedback to address.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.