fix(ci): preserve reports without unauthorized fork PR comments

[rudycelekli]

Summary

Fork pull requests finish generating the test dashboard, then fail when its optional comment attempts to use the read-only workflow token (Resource not accessible by integration, HTTP 403). This occurred on #696, #697, #698 and #699.

Run comment steps only when the pull request's head repository matches the current repository. Apply the same guard to the MCP summary and skill-validation report, which contain the same unguarded write. Report generation, artifact uploads, test jobs and the Tier 3 failure gate remain active for fork contributions. Workflow triggers and token permissions are unchanged.

Verification

• npx vitest run tests/unit/scripts/fork-pr-comments.test.ts --bail=0: 12 passed. The exact regression file against the original workflows produces 3 failed / 9 passed.
• The tests load the actual workflow YAML and exercise fork PRs, same-repository PRs, push events and manual dispatch.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -shellcheck= -pyflakes= .github/workflows/optimized-ci.yml .github/workflows/mcp-tools-test.yml .github/workflows/skill-validation.yml: passed. ShellCheck and Pyflakes integrations were disabled; Actions syntax, expressions and structure were checked.
• git -c core.whitespace=cr-at-eol diff --check: passed (the skill workflow already uses CRLF).
• Published head 0686b7cf: all GitHub checks pass. Full coverage executes 23,592 passing tests / 62 skipped, and the fork dashboard succeeds without attempting an unauthorized comment.

Failure modes

• Fork PRs attempting an unauthorized comment: each reporting workflow has a regression proving its reporting job remains enabled while its comment step is skipped.
• Losing comments on same-repository PRs: positive control for each workflow.
• Attempting PR comments on push/manual events: negative controls for each workflow, including events without a pull-request payload.

---

• Every failure mode mentioned in this PR description has either (a) a test that exercises it, or (b) a linked tracking issue.

• Affects published API or CLI surface: no.

• Touches the init flow / npm-publish workflow / init corpus: no.

[proffesor-for-testing]

Reviewed the three workflow guards and the regression test; ran the test locally (12/12) and a Codex adversarial pass, which found no blocking defect in the added guards. The remaining unguarded write it noted (the dorny/test-reporter Checks step in mcp-tools-test.yml, already continue-on-error) is pre-existing and out of scope here.

[proffesor-for-testing]

Thank you for this, @rudycelekli! Fork PRs were finishing their reports and then failing on the comment step with a 403; this guard keeps the dashboard, MCP summary, and Tier 3 skill gate running for contributors while only skipping the comment write, and the YAML-driven regression test makes sure the guard stays in place. Merged.