ci: add zizmor workflow

[Sheraff]

Summary

• Add a pinned zizmor GitHub Actions Security Analysis workflow.
• Harden existing workflows so zizmor passes under the regular persona.

Validation

• GH_TOKEN="$(gh auth token)" /tmp/opencode/zizmor-v1.24.1/zizmor --persona=regular --format=github --color=never -- .
• git diff --check
• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f) }' .github/workflows/*.yml