fix(ci): set persist-credentials false on release checkout

Refs: PSEC-923
Generated-By: claude-guard chain 2726445e314ce3922b06486c6d780b2c
Skills-Applied: artipacked
Skills-Sha: 7dedf1fc9723c0487e7d2b10722852cb5bf2a1835d1e4bb0a462bcc4d3c65a6f
Image-Sha: sha256:20335121a95cc1ec4a70b7a8f9327bf74c23563767143377c640546e0a0e2390

Author: stevebeattie

.github/workflows/release.yaml

@@ -51,6 +51,7 @@ jobs:
 
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           fetch-depth: 0 # fetch all history for all tags and branches
           token: ${{ steps.octo-sts.outputs.token }}