persist-credentials: false prevents actions/checkout from overriding git auth with GITHUB_TOKEN. Manual credential store setup ensures all git pushes (including from @semantic-release/git) use the PAT, which is required to trigger the build workflow on tag push.