V49: CI that cannot be steered by a branch name

[dapiced]

Summary

Before changing anything, I ran zizmor 1.30.1 on the three workflows. It reported 28 findings. After this PR it reports 0.

Finding	Before	Fix
template-injection	1	The deploy step expanded github.head_ref directly inside a run: script. The branch name now reaches the shell through env: DEPLOY_BRANCH.
unpinned-uses	21	Every action is pinned to a full commit SHA, with the release in a trailing comment (# v7.0.1). Dependabot already updates Actions weekly and keeps these pins current.
artipacked	6	Every checkout sets persist-credentials: false. No job pushes, so nothing needs the token on disk.

New CI job: Workflow audit (zizmor)

• It installs zizmor from PyPI at a pinned version (pipx run --spec zizmor==1.30.1) instead of going through a third-party action.
• It passes GH_TOKEN so the online audits run too (impostor commits, ref confusion).
• I could not run those online audits from my dev container, because its proxy blocks zizmor's API calls. This PR's CI is their first real run.

Coverage floor

• CI now runs npm run test:coverage (V8 provider) instead of npm run test.
• The floors are the measured baseline rounded down, not round targets. Baseline on 898 unit tests: 64.56 % statements, 53.28 % branches, 54.46 % functions, 65.62 % lines. Floors: 64 / 53 / 54 / 65.
• These figures cover unit tests only. The UI is mostly exercised by e2e tests, which this does not measure.
• Cost: the quality job takes about one minute longer.

Tests that enforce the rules. supply-chain.test.ts now checks every workflow file for three things:

• every uses: is a SHA followed by a release comment;
• no checkout persists credentials;
• no run: contains a ${{ }} expression with a pull-request-controlled value.

Against the workflows before this PR, 8 of 13 tests fail.

Docs. V49 is marked delivered in PLAN.md, CHANGELOG.md is regenerated, the version is now 1.49.0, and there is a plan doc in docs/superpowers/plans/.

Test plan

• zizmor --offline .github/workflows: 0 findings, down from 28
• lint, format:check, typecheck
• npm run test:coverage: 898 passed, every floor met. A deliberately partial run fails the gate (exit 1).
• npm audit gates pass with @vitest/coverage-v8 added
• First CI run: the online zizmor audit, and the pipx invocation on the runner

🤖 Generated with Claude Code

https://claude.ai/code/session_01ELAjHYDyxa5zbbdcke1bMA

---

Generated by Claude Code