Add zizmor for GitHub Actions security linting

[adamtheturtle]

Add zizmor to dev dependencies and pre-commit config for GitHub Actions workflow security linting.

Changes

• Add zizmor==1.19.0 to dev dependencies in pyproject.toml
• Add zizmor pre-commit hook (runs on YAML files in .github directory)
• Add zizmor to ci.skip list (where applicable)

---

Note

Introduces GitHub Actions security linting with zizmor and hardens workflow permissions.

• Adds zizmor==1.19.0 to dev dependencies and a zizmor pre-commit hook (targets .github YAML); added to ci.skip
• Adds zizmor.yml configuration disabling selected rules
• Hardens workflows: sets permissions: {} in CI and uses actions/checkout with persist-credentials: false in CI and Release

^{Written by Cursor Bugbot for commit c06b487. This will update automatically on new commits. Configure here.}

[cursor]

Setting persist-credentials false breaks git auto commit action

Adding persist-credentials: false to the checkout step will break the release workflow. The stefanzweifel/git-auto-commit-action@v7 used later (line 74) relies on git credentials being persisted in the local git config to push commits. When persist-credentials: false is set, the PAT token from the checkout step is not stored in git config, so the auto-commit action cannot authenticate and the push will fail. This is a documented incompatibility (git-auto-commit-action Discussion #356).