Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package
## Problem
After upgrading to `actions/checkout@v6`, the `update-major-minor-tags`
workflow fails with:
```
fatal: could not read Username for 'https://github.com': No such device or address
```
Example:
https://github.com/astral-sh/ruff-action/actions/runs/21509988231/job/61974754475
## Root Cause
`actions/checkout@v6` changed the behavior of `persist-credentials:
false`. In v6, credentials are immediately cleaned up after checkout,
whereas in v5 they remained available during the job.
The workflow sets `persist-credentials: false` and then tries to `git
push` — but the auth credentials are already gone.
## Fix
Explicitly set `persist-credentials: true` (removing the `false` value).
The workflow already has minimal permissions (`contents: write`) scoped
only to this job, so this is safe.
Added a `zizmor: ignore[artipacked]` comment in case the security linter
flags this pattern.
eifinger-bot