Pre-commit workflow fails: pre-commit/action pulls an unpinned actions/cache

## Summary

Every branch's `Pre-commit` check now fails at job setup, before any step runs:

```
##[error]The action actions/cache@v4 is not allowed in alunduil/blog.alunduil.com
because all actions must be pinned to a full-length commit SHA.
```

`pre-commit/action@v3.0.1` references `actions/cache@v4` internally, and the repo now has `sha_pinning_required: true`:

```
$ gh api repos/alunduil/blog.alunduil.com/actions/permissions
{"enabled":true,"allowed_actions":"all","sha_pinning_required":true}
```

## When it started

`main` was green at 19:26Z today (`a892eef`) and failed at 20:23Z (`1651ca8`). No workflow change between them — the policy flipped in that window. It affects every branch, not one PR.

## Options

- Drop `pre-commit/action` for `pip install pre-commit` + `pre-commit run --all-files`. The action is a thin wrapper over exactly that plus a cache; inlining it puts every action reference under our own pinning. Loses the hook cache unless we add a pinned `actions/cache` step ourselves, which we can.
- Wait for an upstream release of `pre-commit/action` that pins its own uses. Nothing suggests one is imminent.
- Relax `sha_pinning_required`, which gives up the property the setting exists for.

First option looks right, but the setting is presumably deliberate and recent, so worth confirming the intent before changing workflows around it.

## Context

Surfaced while working #240; unrelated to it, and blocks CI verification on #483.