🚑 Drop invoke_* glue checks from staging CI (#12623)

* 🚑 Drop invoke_* glue checks from staging CI

The .github backport from develop added check-no-invoke-v to WASM and
Exporter CI, but staging still ships glue that uses invoke_* wrappers.
Remove those steps (and the WASM production build only used by the
check) so staging CI matches the binary it builds.

* 🔧 Disable credential persistence in commit-checker checkout

zizmor fails CI: Workflows when actions/checkout omits
persist-credentials: false. Match the rest of the workflows.

.github/workflows/commit-checker.yml

@@ -58,6 +58,7 @@ jobs:
       - name: Checkout trusted code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ github.event.pull_request.base.sha || github.sha }}
 

.github/workflows/tests-exporter.yml

@@ -61,8 +61,3 @@ jobs:
         working-directory: ./exporter
         run: |
           ./scripts/test
-
-      - name: Check no invoke_* in exporter JS glue
-        working-directory: ./render-wasm
-        run: |
-          ./check-no-invoke-v export

.github/workflows/tests-wasm.yml

@@ -60,13 +60,3 @@ jobs:
         working-directory: ./render-wasm
         run: |
           ./test
-
-      - name: Build
-        working-directory: ./render-wasm
-        run: |
-          NODE_ENV=production ./build frontend
-
-      - name: Check no invoke_*V in JS glue
-        working-directory: ./render-wasm
-        run: |
-          ./check-no-invoke-v