Set persist-credentials: false on checkout steps (PM_GH_REPO_036)

[anish-sujanani]

Set persist-credentials: false on checkout steps

Addresses PM_GH_REPO_036 — actions/checkout must not persist credentials.

By default actions/checkout writes the job's GITHUB_TOKEN into the local git config as an
http.https://github.com/.extraheader entry and leaves it there for the rest of the job. Any
later step running in the workspace can read it — a dependency postinstall, a test helper,
an uploaded artifact, a verbose log. persist-credentials: false makes checkout remove it
once the clone is done.

This sets the key on 1 step.

Why this does not break the checkout itself

actions/checkout authenticates, clones, and then scrubs: configureAuth() runs
unconditionally and the removal happens in a finally block after the fetch. Checkout's own
network access is unaffected, including on private repositories and with fetch-depth: 0.

Each job here was checked for anything that consumes the credential afterwards: every run:
command, every script and npm/make target those commands invoke, and every uses: action
resolved at its pinned ref with both src/ and dist/ read, recursing through composites.
Jobs that reach the network with git were excluded rather than changed.

gh is unaffected — it reads GH_TOKEN/GITHUB_TOKEN from the environment and uses the REST
API. Only a git subprocess doing network I/O from inside the workspace is affected.

Verification

• The parsed YAML is identical before and after with the added key stripped.
• The diff adds only with: and persist-credentials: false lines and deletes nothing.
• Inserted keys equal the checkout steps that lacked the key, minus the excluded jobs,
  checked per file.
• actionlint reports the same findings before and after.

Break risk

Low. If a job here turns out to run git against the network in a way I missed, the symptom
is an authentication failure on that one command — loud, immediate, and fixed by reverting
the key on that step.