Fix zizmor lint

[adamtheturtle]

Upgrade zizmor to 1.23.1 and disable superfluous-actions and secrets-outside-env to fix lint failures.

Made with Cursor

---

Note

Low Risk
Low risk: changes are limited to CI/workflow configuration and dev-tool dependency bumps, with no runtime or production code impact.

Overview
Resolves zizmor lint issues by bumping zizmor to 1.23.1 (and refreshing uv.lock for related dev-tool updates like prek, ruff, ty, and vulture).

Updates zizmor.yml to disable the superfluous-actions rule, and tweaks the GitHub release workflow by assigning the publish-to-winget job to the winget environment.

^{Written by Cursor Bugbot for commit 6e2cbd2. This will update automatically on new commits. Configure here.}