Reference in-repo workflows with GitHub's self-repository syntax
zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a self-repository audit that flags workspace-relative uses: ./... references to in-repo actions and reusable workflows. This repo pins zizmor-action 0.6.2 and would fail the audit on the next Dependabot bump. GitHub's uses: $/... form is the syntax GitHub now recommends for same-repository references and the one zizmor's audit requires. For a job-level reusable-workflow call it changes nothing at runtime: ./ already resolves to the caller's commit, and reusable workflows are exempt from the org SHA-pinning policy, so the gain is conformance with the recommended form, not security. The seven smithy-verify.yml calls (six release workflows and test.yml) now use it.
actionlint 1.7.12 rejects the new form and no release knows it yet (rhysd/actionlint#711), so the existing .github/actionlint.yaml also ignores that one message for workflow files, with a note to drop it once a release does. Locally, zizmor 1.30.0 goes from 7 self-repository findings to 0 and actionlint exits 0 with the config (and 1 without it).
CI's audit job on this PR is the proof.
Same change as basecamp/hey-sdk#171 and #174.
Summary by cubic
Switches in-repo reusable workflow calls from ./.github/workflows/smithy-verify.yml to $/.github/workflows/smithy-verify.yml in the seven release workflows and test.yml to satisfy zizmor 1.30.0's self-repository audit and avoid failing the next Dependabot bump. Adds an actionlint ignore for the new syntax, scoped to the exact calls so new $/ sites require an explicit config edit; drop the ignore once actionlint supports the form.