Set persist-credentials: false on pull-request workflows that run repository scripts

[hatayama]

Context

CodeRabbit flagged missing persist-credentials: false on the new dead-code workflow in PR #1995. That workflow runs repository-controlled tests/scripts on pull requests, so leaving GITHUB_TOKEN in local Git config lets untrusted PR code read it.

The same risk still applies to other pull-request workflows that run repository scripts but do not yet disable credential persistence.

Workflows still missing persist-credentials: false

• .github/workflows/code-complexity.yml
• .github/workflows/build-and-test.yml
• .github/workflows/security-scan.yml
• .github/workflows/unity-compile-check-and-test-runner.yml

Existing precedents (already set)

• .github/workflows/dispatcher-publish.yml
• .github/workflows/native-cli-publish.yml
• .github/workflows/protocol-minimum-version-warning.yml
• .github/workflows/dead-code.yml (added in chore: Fail CI on high-confidence C# dead code and remove leftover readiness probes #1995)

Validation

When updating uses: / checkout options, follow docs/github-actions-security.md and run:

cd cli/release-automation
go test ./internal/architecture -run 'TestWorkflowActions|TestPullRequestWorkflow' -count=1

[hatayama]

Fixed in #2003, squash-merged into v3-beta as f3a3e75.

All four listed workflows now set persist-credentials: false on every actions/checkout step, plus pr-title.yml which met the same condition (pull_request trigger running go run ./cmd/check-pr-title) but was not in the original list.

To keep the rule enforced rather than remembered, TestPullRequestWorkflowsDisableCredentialPersistence was added alongside the existing setup-go cache and Unity cache guards, and the rationale is documented in docs/github-actions-security.md.

Closing manually because Closes #1998 only auto-triggers on merges into the default branch.