persist-credentials: false prevents actions/checkout from overriding
git auth with GITHUB_TOKEN. Manual credential store setup ensures
all git pushes (including from @semantic-release/git) use the PAT,
which is required to trigger the build workflow on tag push.
GITHUB_TOKEN events cannot trigger other workflows by design.
Use a fine-grained PAT (RELEASE_TOKEN secret) so the tag push
from semantic-release triggers the build.yml workflow.
loganandonion-4-dinner