ci: apply zizmor recommendations

[flakey5]

No description provided.

[cursor]

PR Summary

Medium Risk
Changes GitHub Actions permissions/checkout credential handling across CI and deploy workflows, which could break automation (e.g., PR creation, deploy) if permissions are too restrictive or mis-scoped.

Overview
Hardens GitHub Actions workflows by explicitly scoping permissions and disabling actions/checkout credential persistence (persist-credentials: false) in most jobs, while keeping write credentials only where git-auto-commit-action needs them.

Adds a new zizmor workflow that runs on pushes/PRs to report security findings to GitHub via security-events: write, and tweaks Dependabot to use a longer cooldown (default-days: 7) to reduce PR churn.

^{Reviewed by Cursor Bugbot for commit 3fa978f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1fba7f5. Configure here.}

[MattIPv4]

This is a nit, but in some workflows we set permissions at the root, and in others we set it at the job. Can we do it consistently?