ci: reconcile the reusable-workflow pin comment with pinact #663

Problem

Organization guidance disagrees with itself, and with the linter some repositories enable, about the comment on a SHA-pinned reference to an organization reusable workflow.

• PATTERNS.md (action pinning section) allows "a version or branch comment (e.g., # v4 or # main)".
• .github/instructions/github-actions-ci-cd-best-practices.instructions.md asks for # vX.Y.Z comments on every pin (checklist item: "All external actions are pinned to 40-character commit SHAs with # vX.Y.Z comments").
• pinact 4.1.1, enabled through Trunk in z-shell/zunit and z-shell/zpmod, rejects # main: "SHA-pinned action requires a version comment for verifiability".

Every commit-lint and trunk caller in the organization uses @<sha> # main. Where pinact runs, each new caller is a new Trunk security finding. z-shell/zunit#27 and z-shell/zpmod#114 had to work around it with a per-repository .pinact.yaml that ignores z-shell/\.github/\.github/workflows/.* at a 40-hex ref.

Options

1. Settle on the immutable workflow releases from ci: version reusable workflows with immutable releases #543, so callers carry # <workflow>/vX.Y.Z comments that pinact can verify. This removes the conflict at its source.
2. Keep # main for internal reusable workflows, say so in the CI instructions as well as PATTERNS.md, and ship the .pinact.yaml exception from the organization template (or the reusable Trunk configuration) instead of per repository.

Option 1 fits the direction of #543; option 2 is the smaller change until #543 lands.

Evidence

• zunit main weekly Trunk run failed on trunk-check.yml:28 with the pinact message above.
• ci: adopt the organization commit-lint caller zunit#27 and ci: adopt the organization commit-lint caller zpmod#114 added .pinact.yaml in the same form.