fix(ci): exclude .lock files from zizmor

.github/workflows/ci-zizmor.yml

@@ -48,7 +48,14 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Collect workflow files (exclude auto-generated lock files)
+        id: collect
+        run: |
+          files=$(find .github/workflows -name '*.yml' ! -name '*.lock.yml' | sort | tr '\n' ' ')
+          echo "inputs=${files}" >> "$GITHUB_OUTPUT"
+
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
         with:
+          inputs: ${{ steps.collect.outputs.inputs }}
           token: ${{ github.token }}