Keep GITHUB_TOKEN out of .git/config during the dist build

Flagged by CodeRabbit on the multisite PR; applies identically here. The job
runs `npm install` and the webpack/composer dist build against the checkout,
and actions/checkout persists the GITHUB_TOKEN into .git/config by default, so
that build executes with a usable push credential sitting in the working tree.

Verified this is safe rather than assuming it: create-pull-request calls
GitConfigHelper.configureToken() with its own `token` input (defaulting to
github.token) and sets its own http.<host>/.extraheader before pushing - it
even saves and unsets any persisted extraheader first, then restores it
afterwards. So the PR step supplies its own auth and does not read what
checkout persisted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019LoLgW7oFjBPxGea9kiZJ2

Author: pattonwebz

.github/workflows/make-pot.yml

@@ -24,6 +24,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.base || github.ref_name }}
+          # The dist build runs npm and composer against this checkout, so the
+          # GITHUB_TOKEN is kept out of .git/config. create-pull-request does
+          # not need it: it configures its own http.<host>/.extraheader from
+          # its `token` input when it pushes.
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v4