Align zizmor audits and harden release cache isolation

[acgetchell]

Summary

Align local and GitHub Advanced Security zizmor behavior, then reconcile the release benchmark workflow with its stated cache-free artifact policy.

The comparison in acgetchell/causal-triangulations#270 found that an offline local zizmor scan can miss online findings such as an action SHA/version-comment mismatch. It also found that la-stack's release workflow says durable artifact jobs do not restore caches while the producer invokes taiki-e/cache-cargo-install-action.

Current state

• justfile pins zizmor 1.29.0.
• .github/workflows/zizmor.yml pins zizmor-action v0.6.2 but lets the underlying scanner float to the action default.
• just zizmor runs offline without a GitHub token.
• .github/workflows/release-benchmarks.yml correctly disables Rust toolchain caching and separates the read-only producer from the write-privileged publisher.
• The same producer installs cargo-nextest through a cache-restoring action despite the workflow's explicit no-cache policy.

Acceptance criteria

• Verify the current zizmor and zizmor-action releases from their official repositories.
• Pin zizmor-action by full SHA with the matching readable release comment.
• Pass an explicit zizmor tool version to zizmor-action and synchronize it with zizmor_version.
• Set online-audits: true and the intended persona explicitly in the SARIF workflow.
• Make just zizmor use ZIZMOR_GITHUB_TOKEN, GH_TOKEN, or an authenticated gh auth token when available without printing the token.
• Keep a clearly reported offline fallback for contributors without GitHub authentication.
• Replace or reconfigure the cache-based cargo-nextest installation in the release artifact producer so no writable dependency cache enters the durable benchmark asset path.
• Preserve the separate read-only producer and write-privileged publisher jobs.
• Add repository-owned Semgrep rules and mutation-pair fixtures requiring an explicit zizmor-action scanner version and preventing cache restoration in release artifact producers.
• Keep zizmor's online audit as the authority for action SHA/version-tag resolution instead of duplicating remote tag mappings in Semgrep.
• Validate authenticated and offline zizmor paths, Semgrep fixtures and real scan, actionlint, YAML checks, and the release workflow.

Reference

Use acgetchell/causal-triangulations#270 for the scanner parity and static-guard shape. Compare the final release-cache implementation with delaunay's explicit setup-uv cache disablement and MCMC's cache-free release producer.