chore: make zizmor configuration less verbose

[lengau]

This configures zizmor just once to allow any starflow workflows without hash pinning.

---

• I've followed the contribution guidelines.
• I've signed the CLA.
• I've successfully run make lint && make test.
• I've added or updated any relevant documentation.
• In documents I changed, I added a meta description if one was missing.
• I've updated the relevant release notes.

[Copilot]

Pull request overview

This PR centralizes zizmor configuration to exempt reusable workflows from canonical/starflow from SHA pinning requirements, allowing @main references without repeating inline zizmor: ignore[...] annotations across workflows.

Changes:

• Added a repository zizmor config to allow ref-pinning for canonical/starflow workflows.
• Removed per-line zizmor: ignore[unpinned-uses] annotations from existing reusable-workflow uses: entries.
• Simplified CI workflow YAML by reducing inline lint configuration noise.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/zizmor.yaml	Adds centralized unpinned-uses policy configuration for canonical/starflow.
.github/workflows/tics.yaml	Removes inline zizmor ignore from the Starflow reusable workflow reference.
.github/workflows/qa.yaml	Removes inline zizmor ignores from Starflow lint/test reusable workflow references.
.github/workflows/policy.yaml	Removes inline zizmor ignores from Starflow policy and scan reusable workflow references.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mr-cal]

Smart!