ci: skip secret-dependent steps for PRs from forks

[chideat]

Summary

• PRs opened from forks (e.g. fix: sentinel network partition failover #91) can't access repository secrets or write-scoped tokens, so Send coverage (needs COVERALLS_REPO_TOKEN) and the entire Build and push Docker image job (needs GH_TOKEN to push to ghcr.io and commit Chart.yaml) always fail on them.
• Gate both on github.event.pull_request.head.repo.full_name == github.repository so fork PRs skip them cleanly while unit tests still run.
• Behavior for PRs from branches in this repo is unchanged.

Test plan

• Open this PR (from a same-repo branch): Send coverage and the build job should both run as before.
• After merge, re-run CI on fix: sentinel network partition failover #91 (a fork PR): unit tests run; coverage upload and Docker build are skipped (green-skipped, not failed).

Refs: #91

Generated with Claude Code

[Copilot]

Pull request overview

Updates the PR CI workflow to avoid running secret-dependent steps/jobs when the PR originates from a fork, preventing predictable CI failures while keeping unit tests running for external contributors.

Changes:

• Gate the Send coverage step to run only for same-repo PRs (skips on forks).
• Gate the Build and push Docker image job to run only for same-repo PRs (and still skip Dependabot branches).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Send coverage is now gated for fork PRs, but it will still run on Dependabot PRs (which also typically don’t receive repository secrets). That means COVERALLS_REPO_TOKEN will be empty and goveralls can still fail the job. Consider extending the if to also skip Dependabot PRs (e.g., the same !startsWith(github.head_ref, 'dependabot/') guard used by the build job), or gate on the token being non-empty.

Suggested change

	if: github.event.pull_request.head.repo.full_name == github.repository
	if: github.event.pull_request.head.repo.full_name == github.repository && !startsWith(github.head_ref, 'dependabot/') && secrets.COVERALLS_REPO_TOKEN != ''