Delete checkout credential files, not just config entries

Author: arcivanov

action.yml

@@ -266,10 +266,13 @@ runs:
         git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
         # Remove checkout's credential helpers so the app token in the URL is used
         git config --unset-all http.https://github.com/.extraheader || true
-        # checkout@v6 uses includeIf.gitdir entries pointing to credential files
+        # checkout@v6 uses includeIf.gitdir entries pointing to credential files;
+        # remove entries AND delete the credential files themselves
         git config --local --get-regexp 'includeIf\..*\.path' | while read key value; do
           git config --local --unset "$key" || true
+          rm -f "$value"
         done || true
+        rm -f /home/runner/work/_temp/git-credentials-*.config
         git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
         # Unshallow if needed — shallow clones can cause push failures
         if [ -f "$(git rev-parse --git-dir)/shallow" ]; then