fix: prevent GITHUB_TOKEN from overriding LGTM app token in refresh-library CI

[souravbiswassanto]

Summary

• Add persist-credentials: false to the actions/checkout step so the GITHUB_TOKEN credential helper (extraheader) is not installed
• Remove redundant git remote set-url line — url.insteadOf with the LGTM app token is sufficient

Root Cause

actions/checkout with the default persist-credentials: true installs an http.https://github.com/.extraheader that injects the GITHUB_TOKEN as an HTTP Authorization header. This header takes precedence over URL-embedded credentials set via url.insteadOf, causing git push to authenticate as github-actions[bot] (which lacks write permission) instead of the intended LGTM app token.

Test plan

• Trigger the refresh-library workflow manually via workflow_dispatch and verify the "Update repo" step pushes successfully

🤖 Generated with Claude Code