fix(workflows): restore persisted creds on caller checkout for open-pr

.github/workflows/config-sync.yml

@@ -42,9 +42,15 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout calling repository
+        # zizmor: ignore[artipacked]
+        # Persisted credentials are required: the `actions/open-pr` step
+        # below invokes `git push` which relies on the bearer token that
+        # `actions/checkout` writes into the remote URL. Setting
+        # `persist-credentials: false` here breaks PR creation without
+        # offering meaningful isolation, since this job never executes
+        # content fetched from the central repo (it only reads files
+        # from `.config-sync-source/` to copy them).
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
       - name: Checkout central config source
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/vendored-file-sync.yml

@@ -84,10 +84,17 @@ jobs:
       pr-url: ${{ steps.open-pr.outputs.pr-url }}
     steps:
       - name: Checkout code
+        # zizmor: ignore[artipacked]
+        # Persisted credentials are required: the `actions/open-pr`
+        # step below invokes `git push` which relies on the bearer
+        # token that `actions/checkout` writes into the remote URL.
+        # The caller-supplied `refresh-command` runs in this same job
+        # and could in theory exfiltrate the token, but the caller
+        # also controls the workflow that wires this input — so the
+        # trust boundary is the same as for any caller-owned step.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Run vendored-file refresher
         env: