fix(ci): suppress cosmetic zizmor rules and set dependabot cooldown

Refs: PSEC-923
Generated-By: claude-guard chain 2726445e314ce3922b06486c6d780b2c
Skills-Applied: zizmor-config
Skills-Sha: 7dedf1fc9723c0487e7d2b10722852cb5bf2a1835d1e4bb0a462bcc4d3c65a6f
Image-Sha: sha256:20335121a95cc1ec4a70b7a8f9327bf74c23563767143377c640546e0a0e2390

Author: stevebeattie

.github/dependabot.yml

@@ -5,8 +5,12 @@ updates:
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 3
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 3

.github/workflows/zizmor.yaml

@@ -9,11 +9,15 @@ on:
     paths:
       - '.github/workflows/**'
       - '.github/actions/**'
+      - '.github/dependabot.yml'
+      - '.github/zizmor.yml'
   push:
     branches: ['main']
     paths:
       - '.github/workflows/**'
       - '.github/actions/**'
+      - '.github/dependabot.yml'
+      - '.github/zizmor.yml'
 
 permissions: {}
 

.github/zizmor.yml

@@ -0,0 +1,10 @@
+rules:
+  # Paired with `cooldown.default-days: 3` in .github/dependabot.yml.
+  dependabot-cooldown:
+    config:
+      days: 3
+  # Cosmetic pedantic-only findings — suppressed across the campaign.
+  anonymous-definition:
+    disable: true
+  concurrency-limits:
+    disable: true