Adopt zizmor for GitHub Actions linting across all repos

[smartwatermelon]

Background

The 2026-04-29 GitHub Actions security audit (against GitHub Actions Is The Weakest Link) ran a manual scan across 31 workflow files in 29 repos. Findings were addressed in Tier 1+2 (PRs landed 2026-04-29). Tier 3 is automating that scan so future drift is caught at commit/PR time, not at the next audit.

Proposal

Adopt zizmor — a rust static analyzer for GitHub Actions that catches:

• dangerous-triggers (issue_comment, pull_request_target with checkout)
• cache-poisoning (untrusted cache restoration)
• unpinned-uses (tag-pinned third-party actions)
• template-injection (\${{ github.event.* }} in run:)
• excessive-permissions (broad permissions blocks)

The article specifically recommends zizmor as the detection tool for the 9 patterns it catalogs.

Integration paths

1. Pre-commit hook in ~/.config/pre-commit/config.yaml — catches drift at commit time, free, runs locally. Recommended.
2. Dedicated GitHub Action in smartwatermelon/github-workflows (a new reusable zizmor.yml) — second-line catch on PRs. Each repo would add a one-line caller to wire it up.
3. Both — pre-commit for fast feedback, CI as the enforcement gate.

Tasks

• Pick integration path (pre-commit-only, CI-only, or both)
• If pre-commit: add to ~/.config/pre-commit/config.yaml, document in dev-env README
• If CI: create reusable smartwatermelon/github-workflows/.github/workflows/zizmor.yml, document caller pattern
• Run baseline scan once across all in-scope repos to surface anything the manual audit missed
• Decide which findings are blocking vs. informational

Audit context

• Source PR for the manual audit fixes: see PRs landed 2026-04-29 with chore(ci): ...permissions... and chore(security): ...SHA-pin... titles.
• 8 PRs landed: ralph-burndown#130, homebrew-tap#8, yesteryear#62, juliet-cleaning#35, tensegrity#84, kebab-tax#1217, mac-server-setup#134, swift-progress-indicator#12, github-workflows#63.

🤖 Filed by Claude Code as Tier 3 follow-up to the manual audit.