Secure GitHub Actions workflows

[oiahoon]

Issue number of the reported bug or feature request: Closes #164

Describe your changes

• Pin every third-party action to an immutable commit while retaining version comments for Dependabot.
• Restrict workflow token permissions and disable checkout credential persistence.
• Remove the unused ad-hoc Prettier installation.
• Add the official zizmor action with scoped SARIF permissions.

Testing performed

• uvx zizmor . reports no findings.
• All workflow YAML files parse successfully with Ruby Psych.
• git diff --check passes.
• actionlint v1.7.12 introduces no new diagnostic; its sole SC2102 result for the unchanged pipx run build[virtualenv] line reproduces on main.

Additional context

The pinned commits were verified against the version tags documented beside each action reference.