Upgrade Zizmor and remediate self-repository findings

[lopopolo]

Change class and compatibility

Security tooling and GitHub Actions workflow syntax. This updates the repository's Zizmor pin and adopts GitHub's same-repository action syntax; it does not change the Rust crate API, platform behavior, or MSRV.

Changes

• Upgrade Zizmor from 1.29.0 to 1.30.1. The release is past the one-week cooldown, and the pinned zizmor-action v0.6.4 supports this tool version.
• Replace the six workspace-relative local action references in CI and Audit workflows with GitHub's $/ self-repository syntax. This resolves the new self-repository findings while keeping the audit enabled.
• Record the security-scanner upgrade rule in the dependency-sweep runbook: remediate new findings instead of deferring eligible scanner upgrades.

Upstream references: Zizmor v1.29.0–v1.30.1 compare, v1.30.1 release, GitHub self-repository syntax.

Validation

• mise lock — regenerated the version lock and verified the official release assets across supported platforms.
• mise exec --locked aqua:zizmorcore/zizmor -- zizmor --persona pedantic . — passed with no findings.
• Prettier check on both changed workflows and the dependency-sweep runbook — passed.
• git diff --check — passed.
• No Dependabot pull requests were open during this run.