Skip build-test-promote job for fork pull requests lacking registry secrets

[Copilot]

The Build, Test, Promote (cosmic) / Build image / Build and push image (amd64) job was failing with Error: Input required and not supplied: password during the podman-login step.

Root cause

• The failing run was triggered by a PR opened from an external fork (aaaaadrien/atomic-desktop).
• GitHub Actions withholds repository secrets from workflows triggered by pull_request events when the head repository differs from the base repository — this is a platform-level restriction, not something the workflow can override.
• With secrets.QUAY_PASSWORD unavailable, REGISTRY_TOKEN was empty, so podman-login failed before the image build could even start.
• Confirmed this is fork-specific: pushes to main, same-repo branch PRs, and Dependabot PRs (which run from branches in-repo, not forks) all successfully authenticate and build.

Fix

• Added a job-level if guard to build-test-promote in .github/workflows/build.yml that skips the job for pull_request events when the PR's head repo doesn't match the base repo:

  if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

• All other triggers (push, schedule, workflow_dispatch) and same-repo PRs continue to run unchanged. Fork PRs will now show as skipped instead of failing, since they can never authenticate to the registry.