chore: update rhiza to v1.5.0

[tschm]

Syncs jebel-quant/rhiza from v1.4.2 → v1.5.0. Template-owned files only; nothing
repo-owned was touched.

What changed (14 files)

• 9 workflow stubs repinned to @v1.5.0.
• Makefile is now template-owned. v1.5.0 adds it to the lock's files: list, so the
  shim this repo generated with uvx rhiza-task shim is replaced by the template's copy and
  will be overwritten by every future sync. RHIZA_TASK moves with it: rhiza-task@0.3.1
  → rhiza-task@1.1.0. Repo-specific targets now belong in local.mk (deliberately not
  gitignored), repo-specific tasks in a rhiza_task.tasks entry point.
• rhiza_paper.yml no longer pushes the PDF to an orphan paper branch (rhiza #1494) —
  a refs/heads/paper ref cannot coexist with any paper/<topic> branch. Its permission
  drops from contents: write to contents: read. The durable copy now ships as a site
  asset via the book.
• rhiza_release.yml: the finalise job gains !cancelled() &&, without which the
  needs.*.result OR was silently ANDed with an implicit success() — a conda failure
  stranded the GitHub release as a draft (#1537).
• .pre-commit-config.yaml: hooks gain groups: tags; ruff v0.16.2 → v0.16.4,
  betterleaks v1.7.4 → v1.8.1, uv-pre-commit 0.12.3 → 0.12.5, validate-pyproject
  v0.25 → 0.26, rhiza-hooks v1.2.0 → v1.3.0, and the new check-managed-files hook
  that refuses commits touching lock-listed paths.
• docs/paper/README.md, .gitignore: documentation of the two changes above.

Conflicts

One — .gitignore — resolved by taking upstream, per the rule that a rhiza-managed file
is the template's to own. The block was an added comment about local.mk not being ignored;
no local content was lost.

Left unstaged

Nothing. The working tree is clean.

Follow-ups for a human (not done here)

• origin/paper still exists (86f4e92) and is now nobody's job to update. Once nothing
  links to it: git push origin --delete paper.
• CLAUDE.md rule 4 lists the rhiza-managed paths and does not yet include Makefile; its
  Commands section also describes RHIZA_TASK as "the whole version contract" pinned in a
  repo-owned Makefile. Both are now stale. CLAUDE.md is repo-owned, so this PR leaves it
  alone.

No gates were run — /update syncs, it does not score. Run /rhiza:quality for a
scorecard, and note the rhiza-task major bump makes a local make all worth doing before
merge.

[Copilot]

Pull request overview

Syncs this repository’s Rhiza template from jebel-quant/rhiza@v1.4.2 to @v1.5.0, updating only template-managed infrastructure/config so the repo continues to track Rhiza’s standardized CI, tooling, and governance.

Changes:

• Repins Rhiza reusable workflow stubs from @v1.4.2 → @v1.5.0 (including updated release finalisation if: logic and reduced permissions for the paper workflow stub).
• Moves the Makefile shim into template ownership and bumps the task-runner pin (RHIZA_TASK) to rhiza-task@1.1.0, directing repo-specific targets to local.mk.
• Updates pre-commit hook revisions and adds groups plus the new check-managed-files hook to enforce template ownership.

Reviewed changes

Copilot reviewed 13 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Makefile	Template-owned rhiza-task shim; updates pin to rhiza-task@1.1.0 and preserves bootstrap behavior.
docs/paper/README.md	Documents the new durable-paper approach via the built site (book asset), not a paper branch.
.rhiza/template.yml	Updates Rhiza template ref to v1.5.0.
.rhiza/template.lock	Updates template lock metadata and adds Makefile to the managed files: list.
.pre-commit-config.yaml	Bumps hook revisions; adds groups and introduces check-managed-files.
.gitignore	Adds guidance comments re: local.mk being intentionally committed/not ignored.
.github/workflows/rhiza_weekly.yml	Repins reusable workflow to @v1.5.0.
.github/workflows/rhiza_scorecard.yml	Repins reusable workflow to @v1.5.0.
.github/workflows/rhiza_release.yml	Repins reusable workflow to @v1.5.0 and updates finalise-job condition.
.github/workflows/rhiza_paper.yml	Repins reusable workflow to @v1.5.0 and reduces contents permission to read-only.
.github/workflows/rhiza_marimo.yml	Repins reusable workflow to @v1.5.0.
.github/workflows/rhiza_codeql.yml	Repins reusable workflow to @v1.5.0.
.github/workflows/rhiza_ci.yml	Repins reusable workflow to @v1.5.0.
.github/workflows/rhiza_book.yml	Repins reusable workflow to @v1.5.0.
.github/workflows/rhiza_benchmark.yml	Repins reusable workflow to @v1.5.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.