Fix CI workflow: actionlint install, zizmor, and permissions

- Use actionlint's official download script instead of hardcoded URL
  missing the version number in the asset filename
- Use pipx run for zizmor to avoid PATH and PEP 668 issues
- Add explicit permissions: contents: read to both workflows to
  satisfy zizmor's excessive-permissions audit

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -3,6 +3,9 @@ name: Deploy
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest