Add zizmor security linting for GitHub Actions workflows

[strickvl]

Summary

• Adds zizmor GitHub Actions security linter to the CI pipeline
• Configures zizmor to match our security posture (version tags OK, no SHA pinning required)
• Hardens all workflows with explicit permissions and credential controls

Changes

File	Changes
.github/zizmor.yml	Config disabling unpinned-uses (SHA pinning overkill) and ignoring false-positive template-injection findings
.github/dependabot.yml	Added 7-day cooldown config (zizmor auto-fix)
.github/workflows/ci.yml	Added permissions: contents: read, persist-credentials: false, new security-lint job
.github/workflows/release.yml	Added permissions: contents: write, persist-credentials: false
.github/workflows/spellcheck.yml	Added permissions: contents: read, persist-credentials: false
.github/workflows/test-publish.yml	Added permissions: contents: read, persist-credentials: false

Test plan

• CI passes (including new zizmor security-lint job)
• Verify zizmor annotations appear on PR if any issues found

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}