ci(verifiability): stop actions/checkout leaving a token on disk

Superagent flagged the contradiction, and it was right: actions/checkout
defaults to persist-credentials: true, which writes an authenticated
http.extraheader into .git/config. This job's entire claim is that it reproduces
what an anonymous stranger sees, so withholding the token from the verify step's
env while leaving a usable credential in .git/config is theatre -- anything the
step runs could still pick it up.

Nothing in the job needs it. The only step that talks to GitHub is the
tracking-issue step, which uses gh with an explicit GITHUB_TOKEN in its own
environment; gh reads that variable directly and never consults git's
credential config.

Author: JSONbored

.github/workflows/verify-public-claims.yml

@@ -62,6 +62,17 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # `persist-credentials: false` is load-bearing here, not hygiene. actions/checkout defaults to TRUE,
+          # which writes an authenticated `http.extraheader` into `.git/config` -- so the verify step would run
+          # with a usable GitHub token sitting on disk, and this job's whole claim is that it reproduces what a
+          # stranger sees. Withholding the token from the step's `env:` while leaving it in `.git/config` is
+          # theatre: the credential is still there for anything the step runs to pick up.
+          #
+          # Nothing here needs it. The only step that talks to GitHub is the tracking-issue step, which uses
+          # `gh` with an explicit `GITHUB_TOKEN` in its own environment -- `gh` reads that variable directly and
+          # never consults git's credential config.
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7