harden: scope release token out of npm test

[askalf]

What

The release job's actions/checkout ran with persist-credentials at its default (true), so the write-scoped GITHUB_TOKEN (contents: write + actions: write + id-token: write) was written into .git/config as an http.<url>.extraheader auth token. The job then runs npm ci and the build/test steps with that credential still on disk — so a malicious or compromised dependency executing during install/typecheck/build/test could read the token out of .git/config and use its write scope (push to the repo, dispatch workflows, mint attestations).

Fix

• Add persist-credentials: false to the checkout step so the token is never persisted into .git/config.
• No push rewrite is needed here: this job never runs git push. It creates the tag and GitHub release through the gh CLI (which authenticates via GH_TOKEN in the step env, not the on-disk git credential), and the read-only git ls-remote origin tag-exists guard works unauthenticated on this public repo. So persist-credentials: false alone is the complete fix.

Everything else is byte-for-byte unchanged: the version-changed gate, tag-exists check, CHANGELOG extraction, gh release create/upload, keyless provenance attestation, and the publish.yml dispatch.

Mirrors the same fix already merged in the sibling truecopy repo.