Summary

• Pull-request CI runs no longer leave GITHUB_TOKEN where code from the pull-request branch can read it.
• A new architecture test blocks any future pull-request workflow from reintroducing the leak.

User Impact

Before: actions/checkout defaults to writing GITHUB_TOKEN into the local Git config
(http.<host>.extraheader). Every pull-request workflow that then executes repository-controlled
code — tests, linters, go run ./cmd/..., shell scripts — gave that code a readable path to the
token. dead-code.yml was hardened in #1995, but the other pull-request workflows were not.

After: no pull-request workflow persists credentials, so a malicious or compromised change on a
pull-request branch cannot read the workflow token out of Git config. Nothing else changes for
contributors — CI behaves exactly as before.

Changes

• Set persist-credentials: false on every actions/checkout step in build-and-test.yml,
  code-complexity.yml, security-scan.yml, unity-compile-check-and-test-runner.yml, and
  pr-title.yml.
• pr-title.yml was not listed in the issue, but it is triggered by pull_request and runs
  repository code (go run ./cmd/check-pr-title), so it meets the same condition and is fixed here.
• None of these workflows run git push / git fetch / git tag after checkout, so nothing
  depended on the persisted token. github/codeql-action/* authenticates through the API token in
  the environment, not through Git config.
• Add TestPullRequestWorkflowsDisableCredentialPersistence, mirroring the existing setup-go cache
  and Unity cache guards, so the rule is enforced instead of remembered.
• Document the rule and its rationale in docs/github-actions-security.md.

Release workflows that genuinely push back to the repository are deliberately left untouched.

Verification

Written test-first: the new test initially failed with all 8 offending checkout steps listed, and
passes after the workflow changes.

cd cli/release-automation
go test ./internal/architecture -run 'TestWorkflowActions|TestPullRequestWorkflow' -count=1   # ok

scripts/check-go-cli.sh   # all modules ok, 0 lint issues

ruby -ryaml -e 'ARGV.each { |p| YAML.load_file(p) }' .github/workflows/*.yml   # 13 files parse

The workflows touched here all run on this pull request, so their green status is the end-to-end
check that nothing after checkout depends on the removed credentials.

Closes #1998