🧰⬆️ Bump CI deps and tame YAML lint tantrums

Fresh PLANTUML, pinned SCP action, and a shiny pre-commit lineup because “latest” is a lifestyle, not a strategy.

.gitea/workflows/publish.yaml

@@ -1,6 +1,7 @@
+---
 name: Publish diagram
 
-on:
+on: # yamllint disable-line rule:truthy
   push:
     branches:
       - main
@@ -24,7 +25,7 @@ jobs:
       - name: copy puml to workspace
         run: ls
       - name: Upload to cdn
-        uses: appleboy/scp-action@v0.1.7
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
         with:
           host: bruynooghe.dev
           username: elizhium