ci: harden CI and automate the release scripts

[jo16oh]

• Pin every action to a commit SHA with pinact
• Add pinact, actionlint and shellcheck to mise.toml
• Run actionlint in CI and in the pre-commit hook
• Publish to npm through OIDC trusted publishing instead of NPM_TOKEN
• Fail the gh-pages checkout step instead of starting an empty gh-pages when worktree add fails
• push-tag: switch to main and pull before tagging, instead of refusing
• bump-version: cut chore/release-X.Y.Z from the latest main, push it and open its PR labelled skip-changelog