Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

GitHub Actions workflows were vulnerable to several security issues
including template injection, credential exposure, and permission
over-scoping. These vulnerabilities could allow attackers to execute
arbitrary code or access sensitive tokens.

This change adds `zizmor` as a pre-commit hook to continuously audit
workflow security and fixes all existing vulnerabilities. The fixes
include pinning actions to commit hashes, moving secrets to dedicated
environments, isolating GitHub context from shell execution, and
restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future
workflow changes will be automatically checked before commit.

- Add KNOWN_ARCHITECTURES frozenset to _py_info.py and export it from
the package's public API
  - Expand normalize_isa() to also normalize i386 and i586 → x86
  - Update test to reference the new constant instead of a hardcoded set

Co-authored-by: Rahul Devikar <radevika@microsoft.com>