ci(workflows): harden workflows with zizmor, add CodeQL and mise tasks

[looztra]

Summary

Replicates the CI hardening done in yamkix (looztra/yamkix#448 and looztra/yamkix#449): zizmor static analysis, tightened token permissions, cache-poisoning protection on the release path, pinned actions, CodeQL code scanning, and mise tasks mirroring the make targets.

Changes

• workflows_checks.yml: run zizmor (via zizmorcore/zizmor-action) alongside actionlint; explicit contents: read / checks: write permissions
• code_checks.yml: top-level contents: read permission and persist-credentials: false on all checkouts; dedicated detect-release step reused by downstream conditions; mise and uv caches disabled on release runs so a poisoned cache cannot reach the (Test)PyPI distribution; pin pypa/gh-action-pypi-publish to v1.14.0 (was an unstable ref); fix deprecated codecov params (files / report_type); switch steps from make to mise run tasks
• lint_pr_titles.yml: scope token to pull-requests: write, document why pull_request_target is safe here (zizmor ignore), pin sticky-comment action to v3.0.5
• publish_docs.yml: keep persist-credentials: true explicitly with justification (mkdocs gh-deploy pushes to gh-pages)
• zizmor.yml: new config ignoring cache-poisoning in code_checks.yml, with rationale
• codeql.yml: new workflow scanning python and actions with build-mode: none, weekly schedule, minimal permissions and pinned SHAs
• toolbox/mise/tasks/toml/: mise tasks (lint, test, dist, docs, venv, precommit, checks) mirroring the make targets; actionlint and zizmor added to .mise.toml tools
• poe_tasks.toml: split ruff:fmt:run into ruff:isort + ruff:fmt
• .pre-commit-config.yaml: add --silent to the yamkix hook

Verification

• zizmor v1.26.1: no findings across all six workflows; actionlint clean
• All 19 mise tasks register; venv:setup, lint:fast, style and two full precommit:run passes exercised locally (no diffs produced)
• The workflows in this PR validate themselves via actionlint + zizmor on this very run

Note

If the GitHub repo has default CodeQL setup enabled, it must be switched off (Settings → Code security) before the advanced workflow can upload results.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.14%. Comparing base (aaa1c27) to head (c7fd3bb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #339   +/-   ##
=======================================
  Coverage   79.14%   79.14%           
=======================================
  Files          11       11           
  Lines         235      235           
  Branches       28       28           
=======================================
  Hits          186      186           
  Misses         45       45           
  Partials        4        4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.