ci: harden the release-PR workflow auth

Checkout now runs read-only with persist-credentials: false so the token
isn't left in the git config for the whole job, and the write-capable app
token is only used at the push step (via the push URL, not persisted). The
job also drops its blanket contents/pull-requests write permissions, since
the default token only needs read and the app token does the writing.

Addresses the review on this PR and clears zizmor's artipacked finding for
this workflow.

Note: AI-assisted (Claude Code), verified with zizmor that the artipacked
finding on this file is gone after the change.

Author: notluquis

.github/workflows/releasepr.yml

@@ -9,14 +9,14 @@ permissions:
 jobs:
   createPR:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
-          token: ${{ secrets.JLAB_APP_TOKEN }}
+          # Read-only checkout: the default token is never persisted into the git
+          # config. The write-capable app token is only introduced at the push
+          # step below.
+          persist-credentials: false
 
       - name: Get package info
         shell: bash
@@ -43,9 +43,11 @@ jobs:
         if: steps.pre-release-exists.outputs.result == 'true'
         env:
           APP_VERSION: ${{ steps.package-info.outputs.version }}
-          GITHUB_TOKEN: ${{ secrets.JLAB_APP_TOKEN }}
+          GH_TOKEN: ${{ secrets.JLAB_APP_TOKEN }}
         run: |
-          set -eux
+          # No -x: the push URL carries the token, so keep it out of the log
+          # (GitHub also masks the secret, this is belt and suspenders).
+          set -eu
           # git checkout -b fails if the branch already exists, which keeps a
           # re-run from opening a duplicate release PR.
           BRANCH_NAME="release-v${APP_VERSION}"
@@ -56,8 +58,13 @@ jobs:
           date +%s > auto-release.log
           git add auto-release.log
           git commit -m "Update auto-release logs"
-          git push --set-upstream origin "${BRANCH_NAME}"
+          # Checkout persisted no credentials, so authenticate this one push with
+          # the app token instead of keeping it in the git config all job long.
+          git push \
+            "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            "HEAD:refs/heads/${BRANCH_NAME}"
 
           gh pr create \
+            --head "${BRANCH_NAME}" \
             --title "Release v${APP_VERSION}" \
             --body "Release v${APP_VERSION}"