ci: lint the workflows through mise in the lint job

[viceice]

Changes

Lints the workflows through mise in the lint job, like containerbase/base#7794:

• mise.toml pins jactionlint, shellcheck (used by jactionlint for run: scripts) and zizmor by their registry names.
• The lint job installs them with jdx/mise-action and runs jactionlint and zizmor --format github, and it runs on ubuntu-slim, like the success job.
• Scheduled builds skip the lint job, they only pick up new releases; build still runs when lint was skipped.
• The commit hook runs jactionlint and zizmor --offline on staged workflow files.
• The README documents mise install and the lint commands.
• The build checkout no longer persists the git credentials (zizmor artipacked); binary-builder gets the token as an input.

jactionlint and zizmor --offline pass locally.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Claude Code (Claude Opus 5.5) made the change and checked it.

Use of AI in replying to PR comments

Who answers review comments:

• @viceice will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• An agent will draft replies and reply autonomously. This is heavily discouraged, and we prefer that there are humans in the loop
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified tests

🤖 Generated with Claude Code