Add zizmor GitHub workflow linter

[CarrotManMatt]

Also resolves suggestion audits by running the tool

[Copilot]

Pull request overview

This PR introduces zizmor as a GitHub Actions/workflow linter (via pre-commit and zizmor.yaml) and applies a set of workflow hardening/cleanup changes consistent with running zizmor in “auditor” mode.

Changes:

• Add zizmor configuration (zizmor.yaml) and install zizmor as a pre-commit hook.
• Update multiple GitHub Actions workflows (concurrency, permissions, checkout credential handling, naming/labels) to address linter guidance.
• Minor documentation/badge casing tweaks in README/CONTRIBUTING.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
zizmor.yaml	Adds zizmor rule configuration (ignore + ref pin policy).
README.md	Normalizes badge label casing.
CONTRIBUTING.md	Normalizes “ruff” naming/casing in docs.
.pre-commit-config.yaml	Adds zizmor pre-commit hook (auditor persona, autofix enabled).
.github/workflows/prevent-migrations-deletion.yaml	Adds concurrency, adjusts permissions placement, tweaks naming/comments.
.github/workflows/pr-auto-updater.yaml	Adds concurrency/default permissions reset and refines GitHub App token permissions.
.github/workflows/check-build-deploy.yaml	Adds concurrency, refines checkout settings, splits pre-commit behavior by event, and refines publishing gates/metadata.
.github/workflows/autofix-pre-commit.yaml	Adds concurrency and refines checkout/shell logic for running pre-commit (prek).

Comments suppressed due to low confidence (1)

.github/workflows/check-build-deploy.yaml:309

• docker/build-push-action needs the repository contents (Dockerfile/build context), but this job never checks out the repo. Without an actions/checkout step, the build will run in an empty workspace and is likely to fail (or build the wrong context). Add a checkout step before the Docker steps.

            - name: Authenticate to container registry
              uses: docker/login-action@v4.3.0
              with:
                password: ${{secrets.GITHUB_TOKEN}}
                registry: ${{env.REGISTRY}}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.