ci: drop persisted checkout credentials and the publish job's cache

zizmor flagged both. actions/checkout leaves the job token in .git/config,
where every dependency install script in the job can read it; no job here
pushes, so set persist-credentials: false on every checkout.

The publish job holds id-token: write, so install there from the registry
rather than from a pnpm store another run cached. setup-node caches by
default once package.json names a packageManager, so removing
`cache: pnpm` alone would keep the cache; set package-manager-cache: false.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: cmdcolin

.github/workflows/publish.yml

@@ -10,6 +10,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -38,11 +40,15 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24.x
-          cache: pnpm
+          # the job that publishes installs from the registry, not from a cache
+          # another run wrote; setup-node caches unless told not to
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
@@ -59,6 +65,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # Notes come from the CHANGELOG.md section git-cliff wrote during
       # `pnpm version`, which is part of the tagged commit — so this needs
       # neither full history nor a second pass over the git log.