[musantro]

Summary

• Harden the GitHub Pages docs workflow so it passes the repository's zizmor policy.
• Pin all docs workflow actions to immutable commit SHAs.
• Scope Pages deployment permissions to the deploy job and disable checkout credential persistence in the build job.

Root cause

The docs workflow still used mutable action tags, workflow-level Pages permissions, and default checkout credential persistence. The rest of the workflow suite had already been updated to the stricter pattern.

Validation

• uvx zizmor .github/workflows/docs.yml
• uvx zizmor .github/workflows
• commit hooks: ty, pytest, and commitizen check