fix: persisting a temporary token with fewer privileges

Author: Yermanaco

.github/workflows/release.yml

@@ -24,7 +24,9 @@ jobs:
         environment: production
         steps:
             - uses: actions/checkout@v6
-
+              with:
+                  persist-credentials: false
+            
             # Do NOT set registry-url here: it writes an .npmrc that conflicts
             # with semantic-release's OIDC authentication.
             # Node 26 bundles npm >= 11.5.1, required for OIDC trusted publishing.