ci: always upload zizmor SARIF results

Adds if: always() to the SARIF upload step so findings are still
surfaced in code scanning when zizmor exits non-zero on detections.

Author: claude

.github/workflows/zizmor.yml

@@ -35,6 +35,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SARIF file
+        if: always()
         uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
         with:
           sarif_file: results.sarif