chore: bump pinned versions

[github-actions]

Supply-chain pin bump — review the recomputed hashes in the diff:

• Pinned tools + binaries in tool/versions.env: sha256s
  recomputed from the upstream release assets, re-verified by
  fetch_verified on every build. See the diff for which moved.

These pins are consumed by every whuppi/ci consumer. The already-pinned
assets were re-hashed before this bump (repoint alarm). Merge once
self-check is green; cut a whuppi/ci release so consumers pick the bump
up through their grouped Dependabot PR.

Auto-generated by self-upgrade.yml

[slopfairy]

Tip

Approved — supply-chain pin bump with all self-check gates green; no hashes weakened or pins floated

The diff touches only tool/versions.env with two bumps:

• ZIZMOR_VERSION 1.27.0 → 1.28.0 — version string only, no hash tracked (pipx resolves from PyPI)
• CHROME_VERSION 151.0.7922.34 → 151.0.7922.47 — patch bump within the same milestone, with all 6 platform SHA256s (chrome + chromedriver × linux/macos/windows) recomputed

All 5 self-check jobs passed on the latest commit:

• Conventional Commit — title is valid
• Workflow lint — zizmor, actionlint, shell lint clean
• Action YAML parse — all composite actions parse
• Internal refs are @main — no stamped version tags leaked
• Pin availability — all pinned assets still reachable

All hashes are 64-char hex strings, the fetch_verified.sh fail-closed gate remains intact, and no float/pin-removal occurred. Marking ready for review and merging once you have confirmed the upstream Chrome for Testing release.

[slopfairy]

This PR was already reviewed (APPROVED) and merged at 2026-07-24T00:24:20Z. All five self-check gates passed on the head commit (fd0a927):

• Conventional Commit: passed
• Workflow lint: passed (zizmor, actionlint, shell lint clean)
• Action YAML parse: passed
• Internal refs are @main: passed
• Pin availability: passed (all assets reachable)

No open inline threads, no new changes since the previous review. Nothing further to do here.