chore: remove config file and inline the rule ignoring so that it's

tunable by workflow instead of global

Added mise.lock file so that sha checksums are done when downloading
dependencies so that they can be cached

Author: Davidonium

.github/workflows/lint-workflows.yaml

@@ -20,4 +20,3 @@ jobs:
         with:
           persona: regular
           min-severity: medium
-          config: .zizmor.yml

.github/workflows/release.yml

@@ -20,9 +20,8 @@ jobs:
       - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
           version: 2026.3.8
-          cache: false
 
       - name: Run GoReleaser
         run: goreleaser release --clean
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # zizmor: ignore[secrets-outside-env]

.github/workflows/releaser-pleaser.yml

@@ -3,7 +3,7 @@ name: releaser-pleaser
 on:
   push:
     branches: [main]
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - edited
       - labeled
@@ -23,6 +23,6 @@ jobs:
       - name: releaser-pleaser
         uses: apricote/releaser-pleaser@a1ce9493fd3f3abe60f22c37249d257bc10081dc # v0.8.0
         with:
-          token: ${{ secrets.RELEASER_PLEASER_TOKEN }}
+          token: ${{ secrets.RELEASER_PLEASER_TOKEN }} # zizmor: ignore[secrets-outside-env]
           extra-files: |
             cmd/qcloud/main.go

.zizmor.yml

@@ -2,3 +2,6 @@
 go = "1.26.0"
 "github:golangci/golangci-lint" = "2.11.3"
 "github:goreleaser/goreleaser" = "v2.14.3"
+
+[settings]
+lockfile = true