chore: secure CI

[henryiii]

Prompted by pypa/hatch#2292.

🤖 AI text below 🤖

• Pin every GitHub Action to a commit SHA with a version comment.
• Add permissions: {} at the workflow level and give each job only the permissions it uses. The publish job keeps id-token, attestations, and contents, each with a comment.
• Add persist-credentials: false to all checkout steps.
• Move matrix and context values into environment variables in run blocks to prevent template injection.
• Add a concurrency group to the CD workflow, and names to the jobs that had none.
• Add the zizmor pre-commit hook, and freeze all hooks to SHAs.
• Update dependabot to monthly grouped updates with a 7-day cooldown, and add a pre-commit ecosystem.
• Add a 7-day cooldown for uv ([tool.uv] exclude-newer) and pixi (exclude-newer in the workspace table).

Held back at their current versions, frozen to SHAs, because the new releases make unrelated source code fail: ruff v0.15.20 (v0.16.1 reformats source), mypy v2.1.0 (v2.3.0 reports new errors), prettier v3.9.4 (v3.9.6 reformats a Markdown link). Each needs its own change set.

hynek/build-and-inspect-python-package moves from v2 to v3.0.1, a major version change. v3 stops force-tagging minor releases; it has no functional change beyond dependency updates.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.73%. Comparing base (140e026) to head (4ac5408).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #739   +/-   ##
=======================================
  Coverage   87.73%   87.73%           
=======================================
  Files          96       96           
  Lines       11206    11206           
=======================================
  Hits         9832     9832           
  Misses       1374     1374           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Saransh-cpp]

Thanks, @henryiii! 🚀

The failing CI is not related to this PR. I am seeing the failure in #735 too.

Edit: the pass check does not seem to be working?

[henryiii]

pass -> Pass (renamed, needs update in settings)