zizmor: add build-zizmor.yml for riscv64 wheels

[luhenry]

• Package: zizmor
• Version: 1.29.0
• Source: https://github.com/zizmorcore/zizmor
• Docs: https://docs.zizmor.sh

Compiles zizmor, a static analysis tool for GitHub Actions/CI security issues, into a maturin bindings = "bin" wheel with no ABI tag (a single compiled executable, not an extension module). Upstream publishes no riscv64 wheel.

Mirrors the linux job of upstream's release-pypi.yml.

Differs from upstream

• Uses PyO3/maturin-action directly with target: riscv64gc-unknown-linux-gnu, manylinux: '2_39' - the riscv64 pairing upstream has no job for.

Testing

• No wheel-level test suite ships (zizmor's own crates/zizmor/tests/*.rs run under upstream's cargo test, never packaged); runs --version/--help, then drives the real audit engine against upstream's own artipacked.yml fixture (expects the known finding) and a clean workflow (expects none).

License: OK

Built on riscv64 CI.