ci: don't persist-credentials on public workflow

[justlevine]

What

Sets persist-credentials: false for public CI repo, and updates docs accordingly.

Why

Related Issue(s):

How

AI Disclosure

Testing Instructions

Screenshots

Additional Info

Checklist

• I have read the Contribution Guidelines.
• My PR title is descriptive and follows the conventional commit message format.
• My code passes all lints (PHPCS, PHPStan, ESLint, etc.).
• My code has detailed inline documentation.
• My code has tests that cover the changes I made.
• I have updated the project documentation as needed.

[Copilot]

Pull request overview

Updates the CI setup for public repositories to avoid persisting GitHub credentials during checkout, and adjusts workflow documentation to describe public vs private workflow variants.

Changes:

• Set actions/checkout persist-credentials: false in .github/workflows/ci.yml.
• Updated .github/workflows/README.md guidance around using *-public.yml workflow variants.
• Downgraded @wordpress/use-recommended-components from error to warn in eslint.config.mjs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
eslint.config.mjs	Relaxes one WordPress ESLint rule severity (unrelated to CI credential persistence).
.github/workflows/README.md	Updates documentation about public/private reusable workflow variants and checkout credentials.
.github/workflows/ci.yml	Disables persisted checkout credentials in the detect job for public CI usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.