[CTX-0013] chore(ci): pin ubuntu-latest to ubuntu-24.04

[Xuepoo]

Pin the fleet to 24.04 ahead of the Ubuntu 26 label migration (7 runs-on lines). No other change.\n\nReview: APPROVE (PX-0040 pin-reviewer).\nGates: actionlint + act -n, green.\n\nPriority: P1 | Area: ci | Labels: chore,P1 | Milestone: v0.1.0 | RFC: n/a | Task: CTX-0013

Summary by CodeRabbit

• Chores
  • Updated the automated build, security analysis, and source snapshot workflows to run on Ubuntu 24.04 instead of the previous default runner. This changes the environment used for these checks and maintenance tasks; it does not change end-user functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 29a95d2e-b8b5-4791-b5e1-4e5da93ef914

📥 Commits

Reviewing files that changed from the base of the PR and between d0c4ecd and 02784fa.

📒 Files selected for processing: 3

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/snapshot-source.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The CI, CodeQL analysis, and source snapshot workflows now run their listed jobs on ubuntu-24.04 instead of ubuntu-latest.

Changes: Runner version updates

Layer / File(s)	Summary
Pin workflow runners .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/snapshot-source.yml	Five CI jobs, the CodeQL analyze job, and the snapshot-source job now use ubuntu-24.04.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 02784

The workflows now use pinned Ubuntu 24.04 runners instead of the moving ubuntu-latest label. No concrete regression is established in the supplied changes, so the PR appears ready to merge.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: pinning GitHub Actions jobs from ubuntu-latest to ubuntu-24.04.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}