fix zizmor checks, nightly builds, and update-version.sh

[jameslamb]

A few things are broken in this repo right now, this fixes them.

nightly builds

See #878

Still not sure of the exact cause, but at a step where we use conda install python to upgrade/downgrade Python in the base environment, all builds where it's different from what was already installed in the condaforge/miniforge image fail like this:

Traceback (most recent call last):
  File "/opt/conda/lib/python3.13/site-packages/conda/exception_handler.py", line 30, in __call__
  File "/opt/conda/lib/python3.13/site-packages/conda/cli/main.py", line 53, in main_subshell
  File "/opt/conda/lib/python3.13/site-packages/conda/cli/conda_argparse.py", line 190, in do_call
  File "/opt/conda/lib/python3.13/site-packages/conda/notices/core.py", line 132, in wrapper
  File "/opt/conda/lib/python3.13/site-packages/conda/notices/core.py", line 82, in display_notices
ImportError: cannot import name 'views' from 'conda.notices' (/opt/conda/lib/python3.13/site-packages/conda/notices/__init__.py)

I suspect this is due to one of these changes to conda's import structure, maybe conda/conda#15879

Force-reinstalling conda before any other operations fixes this.

zizmor checks

When the release/26.08 branch was cut, it removed inline comments like # zizmor: ignore[unpinned-uses].

Commit that broke this: 935ed5a

This causes pre-commit to fail on the release/26.06 branch with a few errors like this:

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/build-test-publish-images.yml:46:11
   |
46 |     uses: rapidsai/shared-workflows/.github/workflows/pr-builder.yaml@release/26.06
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

This fixes that by moving that configuration into a zizmor.yml file, as most other PRs in rapidsai/build-planning#275 did.

update-version.sh

There's one lingering 26.04 reference that was missed when release/26.06 was cut, and one new 26.06 that would be missed the next time we cut a release branch.

This fixes both of those.
Tested like this:

ci/release/update-version.sh --run-context=release '26.08.00'
git grep -E '26\.4|26\.04|26\.2|26\.02'

Notes for Reviewers

Running pre-commit run --all-files before pushing that release commit would have caught the zizmor issue.

[jameslamb]

This is failing with another error also seen in the nightlies. Sorry, I'll put this back to draft until I figure that out.

[bdice]

I'm going to merge this to unblock #879. Thanks so much @jameslamb! If anything else is needed, feel free to ping me.

[bdice]

/merge