## Summary
- Add a zizmor config and CI job that lints `.github/workflows` on every
PR touching it, downloading and attestation-verifying the pinned v1.26.1
release binary (cached across runs)
- Fix the mutable-tag and excess-permission findings zizmor surfaces in
`braintrust-evals.yml`, `publish_image.yml`, and
`self-host-tests-smoke.yml`: pin `actions/checkout`/`actions/setup-node`
to commit SHAs, and scope `pull-requests`/`packages`/`id-token`
permissions down to the specific jobs that need them
## Test plan
- [x] Confirm the `zizmor` job runs and passes on this PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated security scanning for workflow changes on pull
requests.
* Added configuration to allow specific workflow trigger exceptions.
* **Security**
* Tightened GitHub Actions permissions at the workflow level and
re-granted only where required per job.
* Pinned common build action versions to specific commits for more
consistent execution.
* **Maintenance**
* Updated workflow caching and action step annotations without changing
linting or fixing behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Charis