feat(pre-commit): add zizmor GitHub Actions security lint

[smartwatermelon]

Summary

• Adds zizmor as a repo: local pre-commit hook, scoped to .github/workflows/*.yml/*.yaml via files: ^\.github/workflows/.*\.ya?ml$
• Follows the existing language: system convention used by yamllint/markdownlint/luacheck in this config — shells out to a Homebrew-installed binary rather than a hosted pre-commit-hooks repo
• Documents the new hook in pre-commit/README.md (Configured Linters, Required System Tools, troubleshooting, references)

This is the pre-commit integration path (path 1 of 3) proposed in smartwatermelon/dev-env#19, a Tier 3 follow-up to the 2026-04-29 GitHub Actions security audit. The companion documentation PR is smartwatermelon/dev-env#34.

Out of scope: CI-side enforcement (a reusable zizmor.yml in smartwatermelon/github-workflows) is a separate, not-yet-started follow-up — not touched by this PR.

Test plan

• Installed zizmor locally via brew install zizmor and confirmed the binary runs and produces findings against real workflow files
• Ran the hook via pre-commit run --config <config> zizmor against a scratch repo containing a copied workflow file — hook fired, correctly reported findings, exited non-zero
• Verified scoping: hook reports "(no files to check)" / skips when only non-workflow files are staged
• Both code-reviewer and adversarial-reviewer passed locally on both commits in this branch (see git hook output)

Claude-Session: https://claude.ai/code/session_01SsnvQEpWgMxcRocq8bBVSE

[claude]

Documentation and pre-commit config addition for zizmor GitHub Actions security linting. No bugs, reliability regressions, security issues, or data loss risk identified.

VERDICT: PASS

[claude]

Adds documentation and pre-commit configuration for zizmor, a GitHub Actions security linter.

Summary of changes:

• Documents the new zizmor hook in pre-commit/README.md with purpose, scope, and context
• Adds zizmor configuration to pre-commit/config.yaml as a local system hook
• Includes installation instructions for macOS via Homebrew

Review: No blocking issues found. The hook is properly scoped to GitHub Actions workflows only, the configuration is correct for a language: system tool, and documentation clearly explains the requirement to install zizmor locally. This is a new security linting addition with no impact on existing functionality.

VERDICT: PASS