fix(ci): annotations and advanced-security are mutually exclusive

Two mistakes of mine, both caught by CI rather than locally, both from
running a piece of the chain instead of the chain.

1. The zizmor action refuses to start with both `advanced-security: true`
   and `annotations: true`. I switched the first and left the second. Running
   zizmor directly does not exercise the action's own option validation, so
   the local check could not have caught it -- the action wrapper is part of
   the contract and was never run.
   `annotations: false` is the right resolution rather than reverting:
   inline annotations vanish with the run, a Code Scanning alert persists and
   can be triaged. Uploading them is the point of enabling advanced-security.

2. An extraneous `f` prefix on a string literal with no placeholder
   (`tests/test_workflow_hardening_gate.py`). Ruff catches it; I had run only
   pytest locally, not `ruff check src tests benchmarks`.

Local chain now run as the job runs it: Lint `All checks passed!`,
7 passed, and the gate green on the real tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JsDFcKo97HuF5ZLjxa3rRa

Author: marcohost33-maker

.github/workflows/zizmor.yml

@@ -55,5 +55,11 @@ jobs:
           # nie hochgeladen: sie fehlten im Code Scanning nicht mangels
           # Befunden, sondern mangels Upload.
           advanced-security: true
-          annotations: true
+          # Mutually exclusive with advanced-security: the action refuses to
+          # start if both are set. Findings now go to Code Scanning, which is
+          # the point of turning advanced-security on -- inline annotations
+          # vanish with the run, a Code Scanning alert persists and can be
+          # triaged. Not caught locally: running zizmor directly does not
+          # exercise the action's own option validation.
+          annotations: false
 

tests/test_workflow_hardening_gate.py

@@ -75,7 +75,7 @@ def test_a_clean_workflow_is_accepted(tmp_path: Path) -> None:
             # invisible to the gate, every ``actions/checkout`` among them. They
             # were pinned by discipline, not by this check.
             "unpinned action in list form",
-            f"""name: l1
+            """name: l1
 on: [push]
 permissions:
   contents: read