ci: run build-test-push on all PRs, not just same-repo

Fork PRs previously skipped the build-test-push job entirely,
preventing contributors from getting build and test feedback.

Removing the same-repo restriction lets all PRs run the pipeline.
The DockerHub push step was already guarded by credential checks,
and a guard was added to the GHCR push step to prevent failures
on forks where GITHUB_TOKEN is read-only.

Author: yajo

.github/workflows/ci.yaml

@@ -25,7 +25,7 @@ jobs:
       - uses: pre-commit/action@v1.0.1
 
   build-test-push:
-    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     needs: pre-commit
     permissions:
@@ -98,6 +98,7 @@ jobs:
           REGISTRY_USERNAME: ${{ env.DOCKERHUB_LOGIN }}
         run: ./hooks/push
       - name: Push Docker Image to GitHub Registry
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           REGISTRY_HOST: ghcr.io
           REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}