ci: Harden deploy-snapshot with least-privilege token, concurrency, and pinned checkout

Bring deploy-snapshot in line with core's workflow hygiene:

* permissions: contents: read — the job only reads the repo and deploys
  externally, so it needs no write scope.
* concurrency group snapshot-deploy (cancel-in-progress: false) — serialize
  snapshot deploys so two runs cannot race to publish to Central.
* checkout the exact commit that passed CI (workflow_run head_sha) and stop
  persisting the GITHUB_TOKEN in the local git config.

source:jar-no-fork is intentionally not adopted: the archetype has no Java
sources, so a sources jar would be empty and Central does not require one for
maven-archetype artifacts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGSbyBPTxsj73xhYpnxcse

Author: jeffjensen

.github/workflows/deploy-snapshot.yml

@@ -6,17 +6,28 @@ on:
     types: [completed]
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   MAVEN_COMMAND: ./mvnw
   MAVEN_CLI_COMMON: "-e -B"
 
+concurrency:
+  group: snapshot-deploy
+  cancel-in-progress: false
+
 jobs:
   deploy-snapshot:
     if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          persist-credentials: false
+
       - uses: ./.github/actions/jdk-setup
         with:
           server-id: central-publish