PR-E: Add actionlint + zizmor workflow security scanning

[lmeyerov]

Summary

• Add a dedicated workflow scanner lane: .github/workflows/workflow-security.yml.
• Run actionlint (with .github/actionlint.yaml to recognize custom gpu_public runner label).
• Run zizmor high-severity gate using .github/zizmor.yml.
• Upgrade workflow refs from actions/checkout@v3 -> @v4 and actions/setup-python@v4 -> @v5.
• Harden flagged template-injection sites in ci.yml by moving attacker-controlled context values through validated env vars.

Scope Notes

• SHA pinning remains deferred per umbrella issue planning; .github/zizmor.yml disables unpinned-uses for this scheduled phase.
• This PR focuses on scanner baseline and high-signal hardening only.

Validation

• Local actionlint: pass.
• Local zizmor (--min-severity high, config applied): pass.
• PR CI: green prior to latest benign retrigger push; re-running now.

Tracking

• Part of Umbrella: Harden untrusted PR CI + Codex agent security model #1130 (PR-E scheduled scope).