chore: bump pinned versions

[github-actions]

Supply-chain pin bump — review the recomputed hashes in the diff:

• Pinned tools + binaries in tool/versions.env: sha256s
  recomputed from the upstream release assets, re-verified by
  fetch_verified on every build. See the diff for which moved.

These pins are consumed by every whuppi/ci consumer. The already-pinned
assets were re-hashed before this bump (repoint alarm). Merge once
self-check is green; cut a whuppi/ci release so consumers pick the bump
up through their grouped Dependabot PR.

Auto-generated by self-upgrade.yml

[slopfairy]

i went through this but came up with nothing to post. ping me again if i missed something ✨

[slopfairy]

Caution

Requesting changes — zizmor 1.30.0 fails the repo's own workflow-lint gate

🔴 Blocking — must fix before merge

1. tool/versions.env:36 — bumping ZIZMOR_VERSION 1.29.0 → 1.30.0 turns the workflow-lint job red. zizmor 1.30.0 ships a new self-repository audit that flags three uses: ./actions/capabilities/oci-cache sites in .github/workflows/self-check.yml (lines 172, 184, 204); with --persona=auditor the job exits 12 (3 low findings). The PR body says merge once self-check is green, and this bump is exactly what makes it red. Fix in the same PR by applying zizmor's auto-fix at those three sites (uses: $/actions/capabilities/oci-cache), or drop the zizmor bump until self-check.yml is migrated. self-upgrade.yml only rewrites versions.env, so this needs a hand edit.

✅ Checked

• Bump is legitimately sourced: upgrade.sh pulls the version from PyPI's JSON, and the failing job log confirms pipx run "zizmor==1.30.0" resolved and installed from PyPI.
• Only ZIZMOR_VERSION changed; no sha256 moved. zizmor has no pinned hash by design (pipx resolves from PyPI), and every other pin (fvm, chrome, bore, oras, actionlint, pinact) is untouched.
• Conventional Commit, Action YAML parse, Internal refs are @main, Pin availability, and all three oci-cache round-trips pass.