chore: updates to dependencies for CVE fixes + zizmor fixes

[jtroup]

what

• Upgraded all dependencies via uv lock --upgrade to pull in
  CVE fixes
• Removed requirements.txt and its generation hook from
  .pre-commit-config.yaml now that Dependabot parses uv.lock
  natively
• Added zizmor to .pre-commit-config.yaml as a pre-commit hook
• Fixed all zizmor findings in CI/release workflows:
  • Added persist-credentials: false to all actions/checkout
    steps (artipacked)
  • Added explicit permissions: contents: read at workflow and
    job level where missing (excessive-permissions)
  • Replaced ${{ github.ref_name }} inline in a run: block
    with an env variable to prevent template injection
    (template-injection)

why

CVE fixes in transitive dependencies. Dependabot now supports
uv.lock directly, making the generated requirements.txt
redundant. zizmor is added to pre-commit to catch GitHub Actions
security issues early. The workflow fixes address the security
findings zizmor surfaced.

testing

zizmor . reports no findings. Pre-commit hooks pass.

docs

No documentation changes required.

---

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[tvansteenburgh]

Thanks @jtroup