Drop persisted checkout credentials

[biru-codeastromer]

Summary

• set persist-credentials: false on all five checkout steps
• add explicit 10-15 minute bounds to every workflow job
• cancel superseded validation runs per workflow/ref while serializing published-release jobs per tag without cancellation
• lock those properties with workflow contract tests and document the CI trust boundary

Evidence

• make release-gate: 97 passed, 1 optional skip, 91.83% coverage
• contract checks cover five checkout steps, five job timeouts, all workflow concurrency blocks, and release no-cancel behavior
• repository audit, text policy, clean wheel install, dependency audit, example workflow, and Gitleaks passed

This PR is independent of #22-#26 and is ready for maintainer review.

[biru-codeastromer]

The workflow-discovery and formatting-dependent-test blockers are fixed at the new head. Policy tests now parse both *.yml and *.yaml, walk jobs and steps semantically, require boolean persist-credentials: false, positive integer timeouts, per-ref validation cancellation, and non-cancelling per-tag release serialization. Exact local gate: 99 passed, 1 optional skip, 91.83% coverage, repository/dependency/text audits, clean installs, example, and full-history Gitleaks all green.

[biru-codeastromer]

Superseded by merged #41, which preserves this change in the protected v0.4.0 release stack.