ci: harden publish job — no persisted git creds, --ignore-scripts on npm

Two more defense-in-depth findings from the Copilot re-review under the
new GHA credential-safety instructions:
- persist-credentials: false on the check and publish checkouts — those
  jobs don't push, so don't leave GITHUB_TOKEN in the local git config
  (smaller blast radius if a later step uses git/network).
- --ignore-scripts on the pinned `npm install -g` so no dependency
  lifecycle code executes while the publish job holds id-token: write.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: theCodeDrift

.github/workflows/release.yml

@@ -81,6 +81,8 @@ jobs:
       publish: ${{ steps.check.outputs.publish }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false # no git writes here; don't leave the token in git config
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24
@@ -116,6 +118,8 @@ jobs:
       id-token: write # OIDC → short-lived npm auth + build provenance
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false # publish authenticates via OIDC/npm, not git creds
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
@@ -127,7 +131,8 @@ jobs:
       # OIDC trusted publishing + provenance need npm >= 11.5.1. Pin the version
       # (not @latest) so the release is deterministic and a new npm release
       # can't change publish behavior unreviewed; bump this intentionally.
-      - run: npm install -g npm@12.0.1
+      # --ignore-scripts: no lifecycle code runs while the OIDC identity exists.
+      - run: npm install -g npm@12.0.1 --ignore-scripts
 
       - run: pnpm --filter @taskless/cli build