hygiene: finalize GeoIntel public release

.gitea/workflows/managed-validation.yml

@@ -23,6 +23,8 @@ jobs:
     # Gitea Actions does not consistently evaluate the GitHub-style `||`
     # expression for pull-request runs without workflow inputs.
     name: Managed repository validation
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:

.gitea/workflows/release-gates.yml

@@ -19,6 +19,8 @@ concurrency:
 jobs:
   quality:
     name: Compile, test, contracts and builds
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -74,6 +76,7 @@ jobs:
 
   dependency-audit:
     name: Python and npm vulnerability policy
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -112,6 +115,7 @@ jobs:
 
   container:
     name: Production AI image, SBOM and container scan
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps: