[github-actions]

Upgrades the CodeQL CLI from 2.27.2 to
2.27.3.

• .codeql-version pinned to the new release
• every pack under ql/ bumped to match, since a pack tracks the CLI it is compiled for
• the ql-mcp pins in internal/runner/printast.go and internal/harness/copilot.go
  moved to the matching ql-mcp release
• upstream pack dependencies upgraded and lock files refreshed
• the version: pins inside the suites re-pinned from the lock files, and
  customql.ActionsAll kept in step with ql/actions/lib
• make verify passed, including check-versions

Checked against the published ql-mcp v2.27.3 release

This PR was opened before ql-mcp v2.27.3 was published (2026-10-22). Checked against the published release:

• codeql-development-mcp-server@2.27.3 is on npm, and advanced-security/ql-mcp-actions-tools-src@2.27.3 downloads from GHCR.
• The tools pack depends on codeql/actions-all 0.7.0, which matches customql.ActionsAll. Its lock file is identical to ql/actions/lib/codeql-pack.lock.yml.
• ABOM's PrintAST invocation (data extension, query run, bqrs interpret) against the published pack gives output identical to 2.27.2.
• The upstream release renames no tools. Its one behavior change, Entry/Exit nodes in Actions PrintCFG, does not affect ABOM, which keeps no PrintCFG snapshots.
• make itest passes.

Docs (599bec9)

• docs/demo.md installs CLI v2.27.3.
• README.md and docs/deployment/{index,operations}.md no longer say ABOM is unreleased. v2.27.2 is public, and the next release is v2.27.3. Helm is still marked unavailable.

This PR was opened with GITHUB_TOKEN, so its pull_request workflows (Query Unit Tests, Go, UI, Lint) did not run until 599bec9 was pushed.