Address findings from zizmor GitHub Actions audit and tighten
secret hygiene in the reusable workflows:

- Set `persist-credentials: false` on `actions/checkout` to avoid
  leaking `GITHUB_TOKEN` via `.git/config`.
- Move `${{ inputs.* }}` interpolations out of inline shell into
  workflow-level `env:` to prevent template injection.
- Add top-level `permissions: contents: read` to all workflows that
  lacked an explicit permissions block.
- Add `cooldown.default-days: 7` to Dependabot to skip churn from
  fresh point releases.

Tighten secret exposure in the reusable workflows:

- Drop `CI_FAIL_MAILS` and `CLAUDE_CODE_OAUTH_TOKEN` from
  workflow-level `env:`; reference them via the `secrets.*` context
  in `if:` conditions instead so they are not bound to env for
  every step (including third-party actions).
- Scope `GITHUB_TOKEN` to the test runner step (which is where
  `blockers.py` actually reads it).
- Move inline `${{ secrets.TCACHE_* }}` out of `run:` blocks into
  step-level `env:` on the two curl steps.

Wire zizmor into pre-commit via zizmorcore/zizmor-pre-commit v1.25.2
and add zizmor.yml disabling the unpinned-uses rule.

GH_TOKEN was forwarded from each caller as ${{ secrets.GITHUB_TOKEN }}
and then re-exported inside the reusable workflow as GITHUB_TOKEN. The
auto-generated secrets.GITHUB_TOKEN is already available in every job,
including reusable-workflow jobs, so the alias added no permissions
and only obscured intent. Reference secrets.GITHUB_TOKEN directly in
the reusable workflows and remove the GH_TOKEN input plus the matching
line from every caller.

Fix the "Load extra env from file" step: when env-path was set but the
file did not exist, "[ -e ] && cat" returned 1 as the final command
and failed the step under bash -eo pipefail. Switch back to an if-fi
guard so a missing optional file is a no-op, not a failure.

Add a comment to zizmor.yml explaining that unpinned-uses is disabled
deliberately because workflows pin actions by major tag and rely on
Dependabot (with a 7-day cooldown) for bumps.

The `secrets` context is not available in step-level `if:` expressions
(only github, needs, strategy, matrix, job, runner, env, vars, steps,
inputs are). Commit a9eb015 moved CLAUDE_CODE_OAUTH_TOKEN and
CI_FAIL_MAILS out of workflow-level env to avoid leaking them into
every step, but then referenced `secrets.X` directly in step `if:`
expressions, which actionlint rejects and which GitHub silently
treats as empty — the gated steps would never run.

Hoist a non-sensitive boolean per secret to job-level env (where the
`secrets` context is allowed) and check `env.HAS_* == 'true'` in the
step ifs. The secret values themselves stay in `with:` / step-level
env only on the steps that actually consume them.

Also wire actionlint into pre-commit so this class of bug is caught
locally. `-ignore` allows the existing empty-string entries in
`workflow_dispatch` `choice` lists, which represent "use default" and
are accepted by GitHub even though actionlint flags them. Fix two
unrelated SC2001 shellcheck findings exposed by actionlint by
replacing `echo | sed 's/.../g'` with bash parameter expansion.