ci: address zizmor audit findings - #4447

Requested via Slack thread

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• The changes are appropriately documented (if applicable).
• The changes have sufficient test coverage (if applicable).
• The testsuite passes successfully on my local machine (if applicable).

Summarize your changes:

These workflow changes clear the findings zizmor 1.31 reports for this repo in the org-wide audit. All three are adhoc-packages findings in ci.yml: the two npm install -g pnpm@11.21.0 steps and the npm install -g npm@11.19.0 step. These are intentional pinned tool installs, so each is suppressed inline with # zizmor: ignore[adhoc-packages] and the commands are unchanged. Nothing else needed fixing.

Generated by Claude Code