Fix release.yml: remove persist-credentials that breaks git-auto-commit

[adamtheturtle]

Summary

• Remove persist-credentials: false from release.yml as it breaks stefanzweifel/git-auto-commit-action@v7 which needs credentials to push
• Add artipacked to disabled rules in zizmor.yml to suppress the warning

Context

The previous zizmor PR added persist-credentials: false to all workflow files including release.yml. However, this breaks the release workflow because git-auto-commit-action needs credentials to push the changelog update.

Test plan

• CI passes
• Release workflow will work correctly with credentials preserved

---

Note

Release workflow fix

• In release.yml, remove persist-credentials: false from actions/checkout@v6 so stefanzweifel/git-auto-commit-action@v7 can push; keep token: ${{ secrets.RELEASE_PAT }} and full history (fetch-depth: 0).

Static analysis config

• In zizmor.yml, disable the artipacked rule.

^{Written by Cursor Bugbot for commit ed6df46. This will update automatically on new commits. Configure here.}