[woksin]

Added

• Workflow lint audits workflows with zizmor, running offline from a pinned, checksum-verified release. Findings are reported by default, and blocking on findings is opt-in. (part of Lint workflow changes with actionlint and zizmor, and roll out SHA-pinned actions and job-level permissions #187)

[woksin]

Reviewer notes:

• This slice covers the zizmor audit only. Still open under Lint workflow changes with actionlint and zizmor, and roll out SHA-pinned actions and job-level permissions #187: SHA-pinning the remaining actions, rolling out job-level permissions, and clearing the 14 existing zizmor findings so that blocking can become the default.
• Local checks:
  • workflow-lint tests (8), including offline tests that a substituted archive is rejected before extraction on both architectures;
  • actionlint;
  • shellcheck.
• Not run locally: the installer's real download and checksum step, because it is Linux-only. Smoke CI covers it.
• Two quick review rounds. The first asked for hostile-case installer tests; they were added and the second round passed.