fix(cd): disable persist-credentials to ensure WORKFLOW_SECRET PAT is used for tag push

The checkout action defaults persist-credentials to true, which injects
GITHUB_TOKEN into git's http.extraheader. This overrides the PAT embedded
in the git push URL, causing tag pushes to authenticate as github-actions[bot]
instead of the PAT identity. GitHub does not trigger downstream workflows
for GITHUB_TOKEN pushes, which is why docker.yml was never triggered.

Author: snowdream

.github/workflows/cd.yml

@@ -239,6 +239,8 @@ jobs:
     steps:
       - name: "🏗️ Checkout Repository"
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: "📝 Orchestrate Release Lifecycle (Release Please)"
         id: release