zizmor: pin to d25bc25 (Bench CI-style docker run)

Made-with: Cursor

Author: isaiah-grafana

.github/workflows/self-zizmor.yaml

@@ -45,8 +45,8 @@ jobs:
       - zizmor-check
     if: ${{ needs.zizmor-check.outputs.found-files == 'true' }}
 
-    # Reusable workflow: zizmor + grafana-bench (Docker image only, no grafana-bench action). Full SHA required by GitHub; after PR #1777 merge use @main.
-    uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@5b57c42975e38b008a228b0ba2d046f29096bbc9
+    # Reusable workflow: zizmor + grafana-bench (Bench CI pattern, ubuntu-latest). Full SHA required; after PR #1777 use @main.
+    uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@d25bc25c16762fb85728ab9b906c5ae731aef405
     with:
       runs-on: ${{ !github.event.repository.private && 'ubuntu-latest' || 'ubuntu-arm64-small' }}
       fail-severity: high