chore fix zizmor ignore rule setting with a config file instead of inlining (#84)

* chore fix zizmor ignore rule setting with a config file instead of inlining

* remove zizmor comment after version

* clarify why release.yml ignore rule on cache poisoning

Author: Davidonium

.github/workflows/release.yml

@@ -17,8 +17,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      # zizmor: ignore[cache-poisoning] -- mise verifies tool checksums via mise.lock
-      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+      - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3 
         with:
           version: 2026.3.8
 

.github/zizmor.yaml

@@ -0,0 +1,4 @@
+rules:
+  cache-poisoning:
+    ignore:
+      - release.yml # cache poisoning on mise is handled with a lockfile