ci(release): stop persisting credentials in the pin-refs checkout

[thomasboni]

Why

The self-scan on #293 fails (94.7% < 100% threshold): the new checkoutMustNotPersistCredentials control (ISSUE-307) flags the pin-refs job in release.yml — the only checkout in the repo without persist-credentials: false. The GitHub App token was persisted into .git/config and survived for the rest of the job.

What

• Add persist-credentials: false to the pin-refs checkout (and drop the now-unneeded token: input — the repo is public, fetch needs no auth).
• Supply the app token at push time through an env-based credential helper, the same pattern the homebrew job already uses: .git/config only ever stores the literal helper script, never the token, so no credential outlives the step.

Verification

Built Plumber from #293's head and ran the self-scan against this branch with the control enabled:

│ Checkout must not persist credentials │ 100.0% │ 🟢 │
Status: PASSED ✓  (threshold 100, --fail-warnings)

Merging this first unblocks #293's Plumber gate.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Release workflow credential handling only; push behavior is unchanged and aligns with an existing homebrew job pattern.

Overview
Updates the pin-refs job so checkout no longer writes the GitHub App token into .git/config, satisfying the checkout must not persist credentials control.

The Checkout main step now sets persist-credentials: false and drops the checkout token: input (public repo fetch does not need it). Pushes to main still use the release app token via an env-based credential.helper on the pin step—the same approach as homebrew—so only the helper script is stored in git config, not the secret.

^{Reviewed by Cursor Bugbot for commit fe9bb7f. Bugbot is set up for automated code reviews on this repo. Configure here.}