fix(ci): prevent npm lifecycle scripts and remove persisted checkout credentials in lint/test

[DeveloperDurp]

Motivation

• The lint and test jobs materialize static/swagger-ui/ by running a Make target that previously invoked npm install, which executes dependency lifecycle scripts and can leak the checkout's job token when actions/checkout persists credentials and the workflow grants packages: write.
• Hardening the CI path avoids exposing an ephemeral package-write token to untrusted npm lifecycle scripts while preserving the existing materialization step required for //go:embed and templ generation.

Description

• Set persist-credentials: false on actions/checkout in the lint and test jobs of .github/workflows/release.yml so the runner does not leave the GITHUB token in local git config during these jobs.
• Replace the Makefile npm-install recipe from npm install to npm ci --ignore-scripts so dependency lifecycle scripts are not executed during asset materialization.
• Kept the swagger-ui-copy target behavior (copying files from node_modules/swagger-ui-dist into static/swagger-ui/) unchanged so //go:embed requirements continue to be met without running install scripts.

Testing

• Ran make swagger-ui-copy which used npm ci --ignore-scripts and successfully populated static/swagger-ui/ with the expected files.
• Ran repository checks with git diff --check which returned no errors.
• Attempted to run templ generate && go test -v -count=1 ./... but the environment lacked templ and go install was blocked by network/sumdb access, so full test execution is currently blocked by the runtime environment.

---

Codex Task