fix: resolve template-injection issues and harden workflows

[gforsyth]

• fix(ci): remediate template injection risks
• fix(ci): pin all third-party images
• fix(ci): do not persist credentials unless needed
• fix(ci): set permissions explicitly per-job
• fix(ci): set secrets explicitly
• feat(ci): add zizmor to pre-commit checks

[mmccarty]

@gforsyth - I'm good with an admin merge here. We don't need to revive CI as part of this work.