Add zizmor for GitHub Actions security linting

[adamtheturtle]

Add zizmor to dev dependencies and pre-commit config for GitHub Actions workflow security linting.

Changes

• Add zizmor==1.19.0 to dev dependencies in pyproject.toml
• Add zizmor pre-commit hook (runs on YAML files in .github directory)
• Add zizmor to ci.skip list (where applicable)

---

Note

Introduces GitHub Actions security linting and minor workflow hardening.

• Add zizmor==1.19.0 to dev deps in pyproject.toml and include zizmor.yml (also added to check-manifest ignore)
• New pre-commit hook zizmor targeting YAML in .github and added to ci.skip
• Harden workflows: set permissions: {} in CI and persist-credentials: false for actions/checkout@v6 in ci.yml, publish-site.yml, and release.yml

^{Written by Cursor Bugbot for commit 61cd651. This will update automatically on new commits. Configure here.}