Add zizmor for GitHub Actions security linting

[adamtheturtle]

Add zizmor to dev dependencies and pre-commit config for GitHub Actions workflow security linting.

Changes

• Add zizmor==1.19.0 to dev dependencies in pyproject.toml
• Add zizmor pre-commit hook (runs on YAML files in .github directory)
• Add zizmor to ci.skip list (where applicable)

---

Note

Introduces GitHub Actions security linting and tightens workflow security.

• Adds zizmor==1.19.0 to dev deps, new pre-commit hook targeting .github YAML, and zizmor.yml with selected rule disables
• Hardens workflows: sets top-level permissions: {} in ci.yml and lint.yml; configures actions/checkout with persist-credentials: false across ci, lint, publish-site, and release
• Updates pre-commit CI skip list and check-manifest ignore for zizmor.yml; minor workflow YAML cleanups

^{Written by Cursor Bugbot for commit ba613a9. This will update automatically on new commits. Configure here.}