actions/checkout writes the workflow token into .git/config by
default. The update workflows push through the create-pull-request
action's own token input and the releases publish with dedicated
credentials, nothing pushes with the persisted token, so every
checkout now sets persist-credentials false.
