Mergeback v4.38.0 refs/heads/releases/v4 into main

Bumps the npm-minor group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@octokit/core](https://github.com/octokit/core.js) | `7.0.7` | `7.0.8` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.0` | `5.4.1` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `64.2.1` | `64.3.4` |
| [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.68.0` | `8.69.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |



Updates `@octokit/core` from 7.0.7 to 7.0.8
- [Release notes](https://github.com/octokit/core.js/releases)
- [Commits](octokit/core.js@v7.0.7...v7.0.8)

Updates `js-yaml` from 5.4.0 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.0...5.4.1)

Updates `eslint-plugin-jsdoc` from 64.2.1 to 64.3.4
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v64.2.1...v64.3.4)

Updates `globals` from 17.11.0 to 17.12.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.11.0...v17.12.0)

Updates `typescript-eslint` from 8.68.0 to 8.69.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/typescript-eslint)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

---
updated-dependencies:
- dependency-name: "@octokit/core"
  dependency-version: 7.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.3.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.69.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions-minor group with 1 update in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java).


Updates `actions/setup-java` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@dd06d9c...de7274f)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…thub/workflows/actions-minor-4cf73e6ad1

Bump actions/setup-java from 6.0.0 to 6.0.1 in /.github/workflows in the actions-minor group across 1 directory

…r-a30b170aad

Bump the npm-minor group across 1 directory with 6 updates

Bumps [@octokit/types](https://github.com/octokit/types.ts) from 17.0.0 to 18.0.0.
- [Release notes](https://github.com/octokit/types.ts/releases)
- [Commits](octokit/types.ts@v17.0.0...v18.0.0)

---
updated-dependencies:
- dependency-name: "@octokit/types"
  dependency-version: 18.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Migrate `changetool` to `pr-checks`

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Update dependencies

…mpDir

Always clean-up temp dirs in `withTmpDir`

Co-authored-by: Michael B. Gale <mbg@github.com>

Rename `validate-changelog` to `changenotes`

Move `withTmpFile` next to `withTmpDir`

…r-b347c7d8de

Bump the npm-minor group across 1 directory with 3 updates

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Separate CodeQL bundle resolution from installation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Use per-language CodeQL bundles

Merge main into releases/v4

This reverts commit ce74b73.

This reverts commit 3490969.

….1-1c5b67565