fix(ci): apply CodeRabbit review fixes

- Rename tag prefix from omar-test-pr- to pr-
- Add contents: read permission to publish workflow
- Disable persist-credentials on checkout step

.github/workflows/on-pr-docker-cleanup.yml

@@ -11,7 +11,7 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_TAG: omar-test-pr-${{ github.event.number }}
+  IMAGE_TAG: pr-${{ github.event.number }}
 
 jobs:
   delete-image:

.github/workflows/on-pr-docker-publish.yml

@@ -7,6 +7,7 @@ on:
       - dev
 
 permissions:
+  contents: read
   packages: write
 
 env:
@@ -26,6 +27,8 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Docker meta
         id: meta
@@ -33,7 +36,7 @@ jobs:
         with:
           images: "${{ env.GHCR_REPO }}"
           tags: |
-            type=raw,value=omar-test-pr-${{ github.event.number }}
+            type=raw,value=pr-${{ github.event.number }}
 
       - name: Log in to the Container registry
         uses: docker/login-action@v4