ci: workflow consistency tweaks (#772)

- zizmor: target `pull_request` at `main` to match every other
  workflow (all PRs base on main), and normalize the two SHA-pin
  comments to the repo's `#vX.Y.Z` style (no space).
- deploy-main: skip docs-only pushes via `paths-ignore: ['**.md']`;
  the deploy target is `example/`, unaffected by repo markdown, and
  no cleanup depends on this job running.

Deliberately not adding paths-ignore to deploy-delete: deploy.yml
creates a preview for every PR (no path filter), so deploy-delete must
run on every close to clean up md-only PRs' previews.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: andykenward

.github/workflows/deploy-main.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - '**.md'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/zizmor.yml

@@ -5,7 +5,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: ['**']
+    branches: [main]
 
 # Deny all permissions by default; grant only what's needed per job
 permissions: {}
@@ -20,9 +20,9 @@ jobs:
       actions: read # only needed for private or internal repos
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d #v0.5.6