ci: disable credential persistence in release checkout

actions/checkout persists the workflow GITHUB_TOKEN as an
http.extraheader; the release job grants it contents: read only, so
semantic-release's push permission check failed with EGITNOPERMISSION
before any release step ran. Without persisted credentials git
operations fall back to the GH_TOKEN PAT provided via the
environment, which can push tags.

Author: xobotyi

.github/workflows/release.yml

@@ -23,6 +23,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: "master"
+          # the job token is read-only; git push must use the GH_TOKEN PAT from env
+          persist-credentials: false
       - name: 'Enable corepack'
         run: corepack enable
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0