- Use actionlint's official download script instead of hardcoded URL
missing the version number in the asset filename
- Use pipx run for zizmor to avoid PATH and PEP 668 issues
- Add explicit permissions: contents: read to both workflows to
satisfy zizmor's excessive-permissions audit
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>