fix(workflows): update and harden CI workflows

- Update all workflow and action SHAs to current HEAD (full 40-char format)
- Add zizmor ignore directives for intentional template expansion
- Harden actions against template injection and credential leaks
- Disable credential persistence in checkout actions
- Inline ci.yml jobs instead of calling deleted workflows
- Remove cache-build action (no longer needed)
- Simplify workflow names and titles with minimal branding
- Use packageManager from package.json instead of explicit pnpm version
- Remove unused workflow documentation files

Author: jdalton