Give the CI push token to one step only

- uses: actions/checkout@<sha>
  with: { persist-credentials: false }
- run: npm ci            # PR-controlled postinstall scripts see no token
- run: |
    git add "$OUT"
    git diff --staged --quiet -- "$OUT" && exit 0   # also catches new files
    git -c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)" push origin HEAD:"$REF"
  env: { TOKEN: ${{ secrets.GITHUB_TOKEN }} }