ci(anchor-drift): stop persisting credentials on all six checkout steps (CWE-522) (#55)

Closes #53.

## What this fixes

`.github/workflows/anchor-drift.yml` has **six** `actions/checkout`
steps and, on
`main`, **zero** `persist-credentials` settings — so all six fall back
to the
action's default of `true`, leaving the job token in `.git/config` for
every
subsequent step (CWE-522).

No job in this workflow pushes or otherwise uses the token, and it runs
on
`pull_request` executing repository-controlled code, so the persisted
credential
is exposure with no upside.

## Why it wasn't fixed in #52

This exact commit (`6a5d1a7`) was written as part of PR #52 but
**rejected at push
time**, because the acting token then lacked the `workflow` OAuth scope:

```
! [remote rejected] (refusing to allow an OAuth App to create or update workflow
  '.github/workflows/anchor-drift.yml' without 'workflow' scope)
```

That rejection fails the *whole* push if any single commit touches a
workflow
path, so the validator commit landed while this one did not — which is
why #52
looked complete and was merged around the gap. The scope has since been
granted,
so it is cherry-picked here onto current `main`.

## Verification

Checked semantically by parsing the YAML rather than grepping, so a
comment or a
near-miss key cannot pass:

```
YAML parses OK; checkout steps = 6 ; steps still persisting = []
```

Before, on `main`: 6 checkout steps, 0 `persist-credentials` lines.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/anchor-drift.yml

@@ -22,6 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - name: Check membership manifest and submodule declarations
         run: scripts/check-membership.sh
       - name: Resolve submodule pins
@@ -52,6 +58,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - name: Check upstream spec and governance pins
         run: |
           anchor=".machine_readable/anchors/ANCHOR.a2ml"
@@ -69,6 +81,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79
         with:
           path: "."
@@ -88,6 +106,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79
         with:
           path: "conformance/valid"
@@ -97,6 +121,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - id: negative
         continue-on-error: true
         uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79
@@ -118,5 +148,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # No job here pushes or uses the token; this workflow runs on
+          # pull_request and executes repository-controlled code, so the
+          # default credential persistence in .git/config is exposure with
+          # no upside (CWE-522).
+          persist-credentials: false
       - name: Deed fixtures — all four ruled heads
         run: bash conformance/run-deed-tests.sh