fix: update stale version comments on SHA-pinned actions (ref-version-mismatch)

[planetf1]

Summary

Tracked from #331 (zizmor CI gate). PR #1530 introduced zizmor enforcement and found that version comments on SHA-pinned actions are stale across multiple workflow files — e.g. # v6 should be # v6.0.2, # v5 should be # v5.0.5.

The SHAs are correct and immutable; this is cosmetic hygiene only. There is no security risk, but accurate comments help reviewers verify pins at a glance.

Affected locations (14 instances)

File	Line	Current comment	Correct comment
cut-release-branch.yml	40	# v6	# v6.0.2
docs-publish.yml	69	# v6	# v6.0.2
docs-publish.yml	266	# v4	# v4.0.0
pr-update.yml	29	# v6	# v6.0.2
publish-dev-from-main.yml	49	# v6	# v6.0.2
publish-release.yml	73	# v6	# v6.0.2
publish-release.yml	116	# v6	# v6.0.2
publish-release.yml	168	# v6	# v6.0.2
pypi.yml	30	# v6	# v6.0.2
pypi.yml	65	# release/v1	# v1.14.0
quality.yml	24	# v6	# v6.0.2
quality.yml	35	# v6	# v6.0.2
quality.yml	54	# v6	# v6.0.2
quality.yml	66	# v5	# v5.0.5

Definition of done

1. Update all version comments to match the actual tag the SHA resolves to
2. Remove the corresponding ref-version-mismatch entries from .github/zizmor.yml
3. zizmor reports no ref-version-mismatch findings

Notes

• zizmor --fix can automate these comment updates
• Line numbers may drift if other workflow edits land first — rerun zizmor to get fresh positions before fixing

[planetf1]

Fixed by PR #1530 (1a78bfc) — version comments on all 14 previously-stale lines were corrected in that PR, and the ref-version-mismatch suppression group was subsequently dropped from .github/zizmor.yml since the rule no longer fires anywhere. Confirmed with zizmor 1.29.0 (default and pedantic personas): 0 findings for this rule.