[plan] Fix credential persistence vulnerability in release.md

[github-actions]

Objective

Address the Medium severity security issue (artipacked) in .github/workflows/release.md to prevent credential exposure through GitHub Actions artifacts.

Context

Priority: 🔴 HIGH (Only Medium severity security finding in the scan)

The zizmor security scanner identified a credential persistence vulnerability at line 5876:9 in the "Checkout" step. This could allow credentials to be persisted in workflow artifacts, potentially exposing sensitive data to unauthorized users with artifact access.

Reference: (redacted)#artipacked

Approach

1. Review the checkout step in release.md at line 5876
2. Identify what credentials are being persisted
3. Consult zizmor documentation for recommended remediation strategies
4. Implement one of the following mitigations:
   • Use persist-credentials: false in checkout action
   • Avoid uploading sensitive directories to artifacts
   • Sanitize artifacts before upload
5. Test the workflow to ensure it still functions correctly

Files to Modify

• .github/workflows/release.md (line ~5876)

Acceptance Criteria

• Credential persistence vulnerability eliminated
• Workflow still functions as intended
• Zizmor scan passes without artipacked finding
• Release process tested and verified working

Testing

# Re-run zizmor scan on the modified workflow
gh aw compile release --zizmor

Related to #5294

AI generated by Plan Command for discussion #5280