fix: release workflow CodeQL query-filter and smoke --force-reinstall (#121)

- Switch CodeQL config from paths-ignore to query-filters exclude for
  py/weak-sensitive-data-hashing (paths-ignore doesn't block cross-file
  data-flow findings)
- Add --force-reinstall to smoke pip install so system-site-packages venv
  doesn't skip reinstall when engraphis is pre-installed

Author: Coding-Dev-Tools

.github/codeql/codeql-config.yml

@@ -10,5 +10,6 @@
 
 name: "Engraphis CodeQL config"
 
-paths-ignore:
-  - engraphis/backends/embedder_deterministic.py
+query-filters:
+  - exclude:
+      id: py/weak-sensitive-data-hashing

.github/workflows/release.yml

@@ -100,7 +100,7 @@ jobs:
             index=$((index + 1))
             venv="$RUNNER_TEMP/engraphis-artifact-smoke-$index"
             python -m venv --system-site-packages "$venv"
-            "$venv/bin/python" -m pip install --no-deps "$artifact"
+            "$venv/bin/python" -m pip install --force-reinstall --no-deps "$artifact"
             (
               cd "$RUNNER_TEMP"
               "$venv/bin/python" - <<'PY'