ci: adopt advisory tool-attribution checks

[ss-o]

The current workflow pin rejects recognized automatic tool credits. Update it to the signed revision in z-shell/.github#764, where these produce advisory warnings. Managed agents still omit automatic credits.

Only the pin and its policy comment change. Permissions, triggers, caller inputs, and the commit, title, branch and issue checks are preserved.

Refs z-shell/.github#652. Depends on z-shell/.github#764 before merge. The rationale and evidence live in that policy change.

Validation: Actionlint, YAML formatting and whitespace checks; the shared workflow's 58 behavior checks pass, including attributed commits succeeding and invalid subjects failing. Application source is unchanged.

[ss-o]

Fallback review under ADR-0026: maintainer elected, no Copilot request on 40f06c2

No actionable introduced defects found. Reviewed the complete PR diff against the repository contract and organization criteria.

Workflow and supply chain: pass. The caller pins signed published revision 64a427d8ac33c9ef1dc89af35920eb0d3de9fa9c. Inspection of the old-to-new shared workflow confirms advisory attribution diagnostics while preserving commit, title, branch and issue checks. Its source is byte-identical to the updated organization PR head.

Scope and compatibility: pass. Permissions, event triggers, concurrency ownership and caller inputs are preserved. The policy comment describes warning behavior. No application source changed.

Validation: pass. Actionlint, YAML formatting and whitespace checks passed, and the shared actual-workflow suite passed 58 checks. Current hosted checks are green. Native commit hooks passed without bypass.

Limits: Self-review, not independent approval. Merge depends on adoption of organization PR764. Local application suites were outside this pin-only change; hosted results provide the available integration evidence.