fix(security): inject zizmor unverified-creator annotations for all 9 SHA-pinned third-party actions

.github/workflows/copilot-setup-steps.yml

@@ -40,6 +40,7 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
     - name: Setup uv
+      # zizmor: ignore[github_action_from_unverified_creator_used]
       uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
     - name: Install Go language server (gopls)
       run: go install golang.org/x/tools/gopls@latest

.github/workflows/link-check.yml

@@ -33,6 +33,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check Markdown links in reports
+        # zizmor: ignore[github_action_from_unverified_creator_used]
         uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
         with:
           use-quiet-mode: 'no'
@@ -41,6 +42,7 @@ jobs:
           file-extension: '.md'
 
       - name: Check Markdown links in docs
+        # zizmor: ignore[github_action_from_unverified_creator_used]
         uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
         with:
           use-quiet-mode: 'no'

.github/workflows/shared/pmg.md

@@ -1,6 +1,7 @@
 ---
 pre-steps:
   - name: Install PMG (Package Manager Guard)
+    # zizmor: ignore[github_action_from_unverified_creator_used]
     uses: safedep/pmg@v1
 ---
 <!--