Address linter findings in build-binaries.yml (#15019)

## Summary

Addresses (mostly minor) findings in `build-binaries.yml`. This is 99%
replacing template expansions with shell-interpolated variables, plus
adding `persist-credentials: false` to every checkout.

## Test Plan

See what happens in CI.

---------

Signed-off-by: William Woodruff <william@astral.sh>

Author: woodruffw