chore(ci): bump socket-registry actions to 444b6415 (scan auto-skip)

[John-David Dalton (jdalton)]

Bumps SocketDev/socket-registry action/workflow pins to 444b6415.

Rolls up all three successive cascades into a single pin bump:

1. tool-envs (7ca50837): setup/action.yml exports SOCKET_TOOL_PNPM_*, SOCKET_TOOL_SFW_*, SOCKET_TOOL_ZIZMOR_*, SOCKET_TOOL_AGENTSHIELD_*, SOCKET_TOOL_NODE_VERSION. @socketsecurity/lib resolvability guard + AgentShield install via downloadPackage.
2. checksums-file (fd589015): setup/action.yml adds SOCKET_TOOL_CHECKSUMS_FILE env var pointing at a stable on-runner copy of external-tools.json, usable as a Docker build-context COPY source so Dockerfiles can verify pnpm/zizmor/etc. tool checksums without duplicating per-platform SHAs.
3. matrix scan auto-skip (444b6415): zizmor + ecc-agentshield installs now auto-skip in matrix test cells via strategy.job-total < 2. No user-facing input — PR authors cannot disable scans via workflow inputs. Scans still run exactly once in single-cell jobs (check / lint / type-check).

Mechanical bump; no consumer code changes in this repo.

[John-David Dalton (jdalton)]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 16185f0. Configure here.}