Wait for CodeQL standard-library tags before opening upgrade PRs

[Copilot]

What This PR Contributes

The updater could detect a new CodeQL CLI binary before its matching standard-library tag was published, causing QLT failures in generated upgrade PRs.

• Readiness gating
  • Verifies the exact refs/tags/codeql-cli/v<version> ref in github/codeql.
  • Runs the existing PR pipeline only after both artifacts are available.
• Deferred updates
  • Treats a missing tag as a successful deferral.
  • Reports that no PR was created and the next scheduled run will retry.
• Failure handling
  • Preserves visible failures for API and authentication errors.
  • Fails closed on malformed API responses.

Future Works

• Coordinating publication order between the upstream CodeQL repositories.
• Modifying existing upgrade PRs created before this readiness gate.

• Fixes Wait for the CodeQL standard-library tag before opening upgrade PRs #421

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.