[ondrejmirtes]

Runs every linter from lint-workflows.yml locally (actionlint 1.7.12 with shellcheck, octoscan, poutine 1.1.4, zizmor 1.31.1 --persona=auditor) and fixes what they report. Before this change: actionlint 0, octoscan 10, poutine 12, zizmor 35 findings. After it: 0 for all four.

Fixes

• send-pr.yml: github.ref_name was expanded straight into a run: script (template injection). It is now passed through env. The old version used to be written to $GITHUB_OUTPUT; the PR body is now written to $RUNNER_TEMP/pr-body.md and passed with body-path, so the PR body stays the same.
• persist-credentials: false on every checkout whose git credentials nothing uses. The one exception is "Checkout to commit" in update.yml, because git-auto-commit-action pushes with those credentials. It keeps them and has an inline zizmor ignore. create-pull-request sets its own auth from its token input, so send-pr does not need the persisted credentials either.
• update.yml: adds permissions: contents: read. All pushes use PHPSTAN_BOT_TOKEN, so GITHUB_TOKEN only needs read access. Also removes ref: ${{ github.head_ref }}, which was always empty because that step never runs on pull_request.
• concurrency on all workflows. Lint, PHPStan, lock-issues and update PR runs cancel superseded runs. Update runs on main, release and send-pr runs queue instead, so a commit, tag, release or PR is never cut off halfway.
• actionlint now runs from the rhysd/actionlint Docker image pinned by digest (1.7.12), instead of bash <(curl …/main/…). This matches the current upstream johnbillion/plugin-infrastructure config, and the image includes shellcheck. The problem matcher is still registered.
• setup-php version comments now say # 2.40.0 (the real tag name). The actionlint and lock jobs now have names; the actionlint check name does not change.

Suppressions (reviewed false positives)

• .github/zizmor.yml: secrets-outside-env for the bot token (fixing it means moving the secret into deployment environments, which is a repo settings change), and superfluous-actions for gh-release, create-pull-request and git-auto-commit.
• .github/poutine.yml: github_action_from_unverified_creator_used for the listed SHA-pinned actions.
• octoscan ignore for "checkout with a custom ref". Its static-ref regex is ^[a-zA-Z-]+$, so it flags the fixed branch names PHP-8.x and 2.3.x.