fix: assess and resolve cache-poisoning, excessive-permissions, and artipacked findings

[planetf1]

Summary

Tracked from #331 (zizmor CI gate). PR #1530 introduced zizmor enforcement and found three lower-priority findings that require a maintainer judgement call rather than a purely mechanical fix.

---

Finding 1: cache-poisoning — docs-publish.yml lines 75, 81

astral-sh/setup-uv and actions/setup-node use caching in the build-and-validate job, triggered on push to main. zizmor flags this as a potential cache poisoning vector.

Actual risk: Low. push to main is branch-protected; only maintainers can push.

Options:

1. Add inline # zizmor: ignore[cache-poisoning] on the two uses: lines with a rationale comment
2. Remove enable-cache: true / cache: npm to eliminate caching (slower builds)
3. Keep the current suppression in zizmor.yml

---

Finding 2: excessive-permissions — dispatch-to-contribs.yml line 20

The dispatch job has no permissions: block, inheriting the repo default token scope. The job uses an app token, not GITHUB_TOKEN, so the fix is a one-liner:

  dispatch:
    permissions: {}
    runs-on: ubuntu-latest

---

Finding 3: artipacked — publish-release.yml line 168

The snapshot-docs job's checkout step does not set persist-credentials: false because the job immediately pushes a commit using that credential. This is intentional.

Fix: Add inline # zizmor: ignore[artipacked] with a comment explaining the intent.

---

Definition of done

For each finding: either fix the root cause OR add an inline # zizmor: ignore[rule] with an explanatory comment, then remove the corresponding entry from .github/zizmor.yml.