<!--pre-commit.ci start-->
updates:
- [github.com/tox-dev/pyproject-fmt: v2.18.1 →
v2.20.0](tox-dev/pyproject-fmt@v2.18.1...v2.20.0)
- [github.com/astral-sh/ruff-pre-commit: v0.15.6 →
v0.15.7](astral-sh/ruff-pre-commit@v0.15.6...v0.15.7)
<!--pre-commit.ci end-->

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

GitHub Actions workflows were vulnerable to several security issues
including template injection, credential exposure, and permission
over-scoping. These vulnerabilities could allow attackers to execute
arbitrary code or access sensitive tokens.

This change adds `zizmor` as a pre-commit hook to continuously audit
workflow security and fixes all existing vulnerabilities. The fixes
include pinning actions to commit hashes, moving secrets to dedicated
environments, isolating GitHub context from shell execution, and
restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future
workflow changes will be automatically checked before commit.

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

- Machine ISA (e.g., arm64 from sysconfig.get_platform()) is no longer
unconditionally added as an implicit factor, preventing it from
conflicting with explicit ISA factors in the env name
- When the env name contains an explicit ISA (e.g., py39-x86_64), only
that ISA's factor conditions match — the machine's ISA is excluded
- When no env factor conflicts (e.g., env is just py39), the machine ISA
still works as an implicit factor
- Fix applied to both INI (filter_for_env) and TOML (_replace_if_toml)
config paths

<!-- Thank you for your contribution!

Please, make sure you address all the checklists (for details on how see
[development
documentation](http://tox.readthedocs.org/en/latest/development.html#development))!
-->

- [ ] ran the linter to address style issues (`tox -e fix`)
- [ ] wrote descriptive pull request text
- [ ] ensured there are test(s) validating the fix
- [ ] added news fragment in `docs/changelog` folder
- [ ] updated/extended the documentation

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Re-enable persist-credentials: true in the prepare-release workflow
checkout step

<!-- Thank you for your contribution!

Please, make sure you address all the checklists (for details on how see
[development
documentation](http://tox.readthedocs.org/en/latest/development.html#development))!
-->

- [ ] ran the linter to address style issues (`tox -e fix`)
- [ ] wrote descriptive pull request text
- [ ] ensured there are test(s) validating the fix
- [ ] added news fragment in `docs/changelog` folder
- [ ] updated/extended the documentation

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>