Resolve zizmor pedantic workflow findings

[bboe]

Clears the remaining advisory zizmor --pedantic findings in this repo's workflows.

Changes

• ci.yml — replace workflow-level read-all with contents: read (excessive-permissions).
• lint.yml — add a concurrency: group (concurrency-limits).
• stale_action.yml / pre-commit_autoupdate.yml — give the jobs explicit name:s (anonymous-definition).
• pre-commit_autoupdate.yml / prepare_release.yml — document why peter-evans/create-pull-request is used (it commits changes / pushes the branch and opens the PR — beyond gh pr create) and silence the superfluous-actions info finding with a justified # zizmor: ignore.
• dependabot.yml — add a 7-day cooldown (dependabot-cooldown).

Verified: zizmor --pedantic reports no findings (2 justified ignores) and actionlint passes.

Follow-up

After release, the package repos get a matching pass (scorecard/pypi/ci/dependabot) and bump their reusable-workflow pins to the new tag.