ci: SHA-pin mlugg/setup-zig (v1.2.2) in provable.yml (#29)

Pins the last unpinned action in `provable.yml` to its commit SHA,
clearing the one remaining advisory Hypatia `unpinned_action` finding
(medium) introduced in #27/#28.

`mlugg/setup-zig@v1` →
`mlugg/setup-zig@53fc45b17fe98b52f92ee5ea08ff48a85a3e7eb7 # v1.2.2`

SHA resolved via `git ls-remote https://github.com/mlugg/setup-zig` (the
`v1` tag points to the same commit as `v1.2.2`). No behaviour change —
same action, same `version: 0.14.0`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Mbq6yKF9RhFai6EQ7WqKhQ

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Mbq6yKF9RhFai6EQ7WqKhQ)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/provable.yml

@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-      - uses: mlugg/setup-zig@v1 # SHA-pin pending (advisory Hypatia medium)
+      - uses: mlugg/setup-zig@53fc45b17fe98b52f92ee5ea08ff48a85a3e7eb7 # v1.2.2
         with:
           version: 0.14.0
       - name: zig build + test