🧰⬆️ Bump CI deps and tame YAML lint tantrums

Fresh PLANTUML, pinned SCP action, and a shiny pre-commit lineup because “latest” is a lifestyle, not a strategy.

.gitea/workflows/publish.yaml

@@ -1,6 +1,7 @@
+---
 name: Publish diagram
 
-on:
+on: # yamllint disable-line rule:truthy
   push:
     branches:
       - main
@@ -24,7 +25,7 @@ jobs:
       - name: copy puml to workspace
         run: ls
       - name: Upload to cdn
-        uses: appleboy/scp-action@v0.1.7
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
         with:
           host: bruynooghe.dev
           username: elizhium

.gitea/workflows/render.yaml

@@ -1,6 +1,7 @@
+---
 name: Render diagram
 
-on:
+on: # yamllint disable-line rule:truthy
   pull_request:
     types: [opened, reopened, edited]
   workflow_call:
@@ -9,7 +10,7 @@ jobs:
   render:
     runs-on: ubuntu-latest
     env:
-      PLANTUML_VERSION: '1.2025.4'
+      PLANTUML_VERSION: '1.2025.10'
     steps:
       - name: Check out repository code
         uses: actions/checkout@v4