Disable persisted credentials in checkout workflow steps

[coderabbitai]

Summary

Configure affected actions/checkout steps with persist-credentials: false so the GitHub token is not retained in local Git configuration while repository-controlled npm commands run.

Rationale

Reducing the lifetime and availability of workflow credentials lowers the risk of token exposure through build or packaging steps.

Affected areas

• .github/workflows/cd.yml
• .github/workflows/ci.yml
• .github/workflows/deps.yml

.github/workflows/e2e.yml already sets persist-credentials: false and does not need changes.

References

• PR: #422
• Review comment: discussion_r3613084710
• Requested by: @tkislan

Acceptance criteria

• Every actions/checkout step in the affected workflows sets persist-credentials: false.
• No checkout behavior unrelated to credential persistence is changed.
• The existing secure configuration in .github/workflows/e2e.yml remains unchanged.