fix: resolve zizmor GitHub Actions security findings

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>