CIH-S02: Gate workflows with zizmor and fix the release.yaml findings #169

Severity: High (2 high-severity cache-poisoning findings in the tag-triggered publish path) · Epic: CIH · Landing order: 3 of 21 · Blocked by: none

Beyond actionlint and the pin tests there is no workflow security linter. Offline zizmor reports 2 high cache-poisoning findings in release.yaml (setup-go cache) and 1 informational superfluous-actions. Add a zizmor --offline --min-severity <pinned> .github/workflows step (one exact version >= 1.30.1 single-sourced in the workflow env: block, installed via uvx zizmor==X or hash-pinned pipx, not go install) and fix the findings (cache: false, drop the superfluous action); no suppression without a # why: line, no skip switch.

Spec: openspec/specs/p5-cih-ci-hardening/spec.md — CIH-S02, REQs REQ-CIH-S02-01, REQ-CIH-S02-02, REQ-CIH-S02-03; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Acceptance (one PR; TDD — failing test first):

• REQ-CIH-S02-01 — gate step in verify.yaml, version >= floor, --min-severity set, no if:/continue-on-error — bash hack/lint/zizmor_gate_test.sh
• REQ-CIH-S02-02 — release.yaml cache-poisoning findings fixed with zero suppressions — bash hack/lint/zizmor_gate_test.sh --self-test
• REQ-CIH-S02-03 (adversarial) — third-party mutable-ref fixture flagged; suppression without # why: red; any ZIZMOR_SKIP* env in a workflow red — bash hack/lint/zizmor_gate_test.sh --self-test

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).