Add zizmor for GitHub Actions security linting

[adamtheturtle]

Add zizmor to dev dependencies and pre-commit config for GitHub Actions workflow security linting.

Changes

• Add zizmor==1.19.0 to dev dependencies in pyproject.toml
• Add zizmor pre-commit hook (runs on YAML files in .github directory)
• Add zizmor to ci.skip list (where applicable)

---

Note

Introduces GitHub Actions security linting and minor workflow hardening.

• Add zizmor==1.19.0 to dev deps and a zizmor pre-commit hook targeting .github YAML; add zizmor to ci.skip
• New zizmor.yml config (disables selected rules); include zizmor.yml in check-manifest ignore
• Set permissions: {} in ci.yml and lint.yml; use actions/checkout@v6 with persist-credentials: false
• In release.yml, keep checkout credentials (with zizmor ignore annotation) for git-auto-commit compatibility

^{Written by Cursor Bugbot for commit 30aee41. This will update automatically on new commits. Configure here.}