fix(ci): skip publish job on fork PRs to prevent permission failures

[zemaj]

Summary

This PR fixes the CI failure in the preview-build workflow when triggered by pull requests from forks. The release and comment jobs were attempting to publish prereleases and post comments for all PRs, including those from forked repositories. Fork PRs don't have write access to create releases in the main repository, causing these jobs to fail.

Changes

• Added a condition to the release job to only run for PRs from the main repository (not forks)
• Added the same condition to the comment job (which depends on release)
• The condition checks: github.event.pull_request.head.repo.full_name == github.repository
• Build and test jobs will still run for all PRs (including forks) to validate the code
• Publishing and commenting are now limited to trusted contexts (same-repo PRs)

Affected Files

• .github/workflows/preview-build.yml

Testing

The change can be validated by:

1. Observing that fork PRs will run the build job but skip release and comment jobs
2. Same-repo PRs will continue to run all jobs as before
3. The workflow YAML syntax has been validated with actionlint

Fixes

• Fixes fix(core/tool-call): sanitize OpenRouter arguments #355
• Fixes fix(ci): install musl targets for preview build #356

🤖 Generated with Claude Code

[zemaj]

Appreciate the workflow patch—could we merge this along with #356? It keeps the publish job off fork PRs so they don’t fail while still letting maintainers trigger it manually. Together with the toolchain update in #356 this should stop preview builds from redlining external PRs.