CI hardening: drop persisted checkout credential in lint workflow

[stevebeattie]

Summary

Small GitHub Actions security-hardening changes to lint.yaml, surfaced by a
zizmor audit of .github/. No behavioral change to the lint job.

Changes

• .github/workflows/lint.yaml — set persist-credentials: false on the
  actions/checkout step. The job only runs setup-python and pre-commit,
  with no git writes, so the checkout has no reason to leave the GITHUB_TOKEN
  in the local git config where later steps could read it. This closes the
  artipacked credential-persistence finding.

• .github/workflows/lint.yaml — normalize the checkout pin's version
  comment from # ratchet:actions/checkout@v4.2.2 to # v4.2.2, matching the
  plain # vX.Y.Z convention used by every other pin in the repo. The SHA is
  unchanged (it is exactly v4.2.2); this only tidies the lone non-standard
  annotation.

• .github/zizmor.yml (new) — disable the cosmetic pedantic-persona rule
  concurrency-limits, with the zizmor workflow's paths: triggers extended
  to include the new config so edits to it re-run the check.

Testing

• zizmor (whole repo): no findings after the change.
• actionlint: clean.
• Patches apply cleanly on top of main; all workflows still parse.
• Independently reviewed by a second pass: no blocking issues.

Refs: PSEC-923