fix(ci): don't persist token in fork PR checkout

Copilot review on #2239 flagged that the fork-controlled checkout
still had the workflow's GITHUB_TOKEN persisted in its .git/config.
Disable credential persistence for that step as defense-in-depth.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: dougaitken

.github/workflows/validate-companies.yml

@@ -37,6 +37,9 @@ jobs:
           # profiles) only, never .github/ workflows or scripts, and nothing
           # from the fork is executed. See https://gh.io/securely-using-pull_request_target
           allow-unsafe-pr-checkout: true
+          # Defense-in-depth: don't persist the workflow token into this
+          # fork-controlled checkout's .git/config.
+          persist-credentials: false
 
       - name: Get changed files
         id: changed