🌱 ci: stop persisting checkout credentials in PR-tree workflows

Set persist-credentials: false on the actions/checkout step of the five
pull_request workflows that run scripts, tests or image builds from the
PR tree (mutation-advisory, pr-overlap, stream-image, ci-runner-image,
docs-index-reminder). None of them pushes or fetches with the job token;
API calls keep getting it via step env under the job's permissions block.

Fixes #17636

Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Author: clubanderson

.github/workflows/ci-runner-image.yml

@@ -106,6 +106,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Resolve the base image and the tag once, up front, so every later step
       # (the exists-check, the build, the summary) agrees on them.

.github/workflows/docs-index-reminder.yml

@@ -48,6 +48,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Find docs added by this PR that the index does not link
         id: check

.github/workflows/mutation-advisory.yml

@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

.github/workflows/pr-overlap.yml

@@ -23,6 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       # Hermetic (local repos + gh double), under a second: a broken check
       # mislabels every open PR, so it must not ship untested (#9319).

.github/workflows/stream-image.yml

@@ -73,6 +73,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # The supervisor scripts have no Go test lane; shellcheck them and run
       # the watchdog decision tests (fake ffmpeg, stubbed Twitch check) here,

src/changelog.d/changed-checkout-no-persist-credentials.md

@@ -0,0 +1 @@
+- CI: the `pull_request` workflows `mutation-advisory`, `pr-overlap`, `stream-image`, `ci-runner-image` and `docs-index-reminder` now check out with `persist-credentials: false`. None of those jobs pushes or fetches with the job token; steps that call the API keep getting it through their step `env`, scoped by the job's `permissions:` block (#17636).