ci: add zizmor workflow

[Sheraff]

Summary

• Add a pinned zizmor workflow for GitHub Actions security analysis.
• Pin existing workflow actions and disable checkout credential persistence.
• Move broad PR write permissions to jobs that need them and use token-authenticated git push URLs where checkout credentials are disabled.

[pkg-pr-new]

Open in StackBlitz

@tanstack/ai

npm i https://pkg.pr.new/@tanstack/ai@551

@tanstack/ai-anthropic

npm i https://pkg.pr.new/@tanstack/ai-anthropic@551

@tanstack/ai-client

npm i https://pkg.pr.new/@tanstack/ai-client@551

@tanstack/ai-code-mode

npm i https://pkg.pr.new/@tanstack/ai-code-mode@551

@tanstack/ai-code-mode-skills

npm i https://pkg.pr.new/@tanstack/ai-code-mode-skills@551

@tanstack/ai-devtools-core

npm i https://pkg.pr.new/@tanstack/ai-devtools-core@551

@tanstack/ai-elevenlabs

npm i https://pkg.pr.new/@tanstack/ai-elevenlabs@551

@tanstack/ai-event-client

npm i https://pkg.pr.new/@tanstack/ai-event-client@551

@tanstack/ai-fal

npm i https://pkg.pr.new/@tanstack/ai-fal@551

@tanstack/ai-gemini

npm i https://pkg.pr.new/@tanstack/ai-gemini@551

@tanstack/ai-grok

npm i https://pkg.pr.new/@tanstack/ai-grok@551

@tanstack/ai-groq

npm i https://pkg.pr.new/@tanstack/ai-groq@551

@tanstack/ai-isolate-cloudflare

npm i https://pkg.pr.new/@tanstack/ai-isolate-cloudflare@551

@tanstack/ai-isolate-node

npm i https://pkg.pr.new/@tanstack/ai-isolate-node@551

@tanstack/ai-isolate-quickjs

npm i https://pkg.pr.new/@tanstack/ai-isolate-quickjs@551

@tanstack/ai-ollama

npm i https://pkg.pr.new/@tanstack/ai-ollama@551

@tanstack/ai-openai

npm i https://pkg.pr.new/@tanstack/ai-openai@551

@tanstack/ai-openrouter

npm i https://pkg.pr.new/@tanstack/ai-openrouter@551

@tanstack/ai-preact

npm i https://pkg.pr.new/@tanstack/ai-preact@551

@tanstack/ai-react

npm i https://pkg.pr.new/@tanstack/ai-react@551

@tanstack/ai-react-ui

npm i https://pkg.pr.new/@tanstack/ai-react-ui@551

@tanstack/ai-solid

npm i https://pkg.pr.new/@tanstack/ai-solid@551

@tanstack/ai-solid-ui

npm i https://pkg.pr.new/@tanstack/ai-solid-ui@551

@tanstack/ai-svelte

npm i https://pkg.pr.new/@tanstack/ai-svelte@551

@tanstack/ai-utils

npm i https://pkg.pr.new/@tanstack/ai-utils@551

@tanstack/ai-vue

npm i https://pkg.pr.new/@tanstack/ai-vue@551

@tanstack/ai-vue-ui

npm i https://pkg.pr.new/@tanstack/ai-vue-ui@551

@tanstack/openai-base

npm i https://pkg.pr.new/@tanstack/openai-base@551

@tanstack/preact-ai-devtools

npm i https://pkg.pr.new/@tanstack/preact-ai-devtools@551

@tanstack/react-ai-devtools

npm i https://pkg.pr.new/@tanstack/react-ai-devtools@551

@tanstack/solid-ai-devtools

npm i https://pkg.pr.new/@tanstack/solid-ai-devtools@551

commit: f1f1d54