ci: harden GitHub Actions security

[kratsg]

Summary

• Pinned all GitHub Actions to full-length commit SHAs with version comments (actions-up, then hand-verified against the GitHub API).
• Added least-privilege permissions: blocks:
  • deploy.yml: workflow-level permissions: {} (the dispatch step uses a dedicated PAT, not GITHUB_TOKEN).
  • docs.yml: workflow-level permissions: {}, build job scoped to contents: read, deploy job keeps its existing documented pages: write / id-token: write.
• Set persist-credentials: false on the docs.yml checkout step (it never pushes).
• Added a concurrency group to deploy.yml (docs.yml and semantic-pr-check.yml already had one).
• Named the previously-anonymous trigger-gitops, build, and deploy jobs.
• Added the zizmor pre-commit hook (^\.github only, --persona=pedantic) so these checks run locally and in CI.
• Dependabot: switched the github-actions group's Dependabot config to the modern github-actions alias (was actions), monthly grouped updates (was weekly), and a 7-day cooldown.
• Froze every existing pre-commit hook rev to its commit SHA (no version bumps — all hooks stay on the same tag they were already pinned to).
• Added exclude-newer = "7d" to pixi.toml so newly published conda-forge/PyPI releases get a 7-day cooldown before pixi will pick them up.

Major version changes

None. actions-up resolved every action to the same tag it was already on (just newly SHA-pinned), and prek auto-update --freeze kept every pre-commit hook at its current tag.

Held-back items

None. Nothing needed to be held back at an older version.

zizmor ignores

• dangerous-triggers on semantic-pr-check.yml's pull_request_target trigger: the job never checks out the PR head and only reads the PR title via the GitHub API (amannn/action-semantic-pull-request); pull_request_target is required so statuses: write works for PRs opened from forks (a plain pull_request trigger from a fork gets a read-only token and can't set a commit status). Documented inline as a # zizmor: ignore[dangerous-triggers] comment with rationale.

Verification

• uvx zizmor --persona=pedantic .github → clean (No findings to report, 1 ignored/documented as above).
• uvx prek run --all-files → all hooks pass except shellcheck, which fails on docs/slac/SLACuser_setups.txt (pre-existing warnings unrelated to this change set — confirmed identical failure on origin/main before any of these edits, and the shellcheck hook version was not bumped). Out of scope per CI-security-only scope guard; flagging for a separate fix.
• All uses: refs in .github/workflows/ are pinned to full 40-character SHAs (spot-checked against gh api repos/<owner>/<repo>/git/refs/tags/<tag>).