Revert "ci: harden fork PR checks"

This reverts commit a4cdba1.

Author: strongkeep-debug

.github/workflows/api-schema-diff.yml

@@ -140,7 +140,7 @@ jobs:
           cat api-diff-report.txt
 
       - name: Post diff to PR
-        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        if: always()
         uses: actions/github-script@v7
         with:
           script: |

.github/workflows/deploy-staging.yml

@@ -64,7 +64,6 @@ jobs:
   # ── 1. Deploy PR branch to staging EC2 ─────────────────────────────────────
   deploy:
     name: Deploy to staging EC2
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment:

.github/workflows/security-scan.yml

@@ -29,7 +29,7 @@ jobs:
           cache: pip
 
       - name: Install bandit
-        run: pip install bandit[toml] bandit-sarif-formatter
+        run: pip install bandit[toml]
 
       - name: Run Bandit
         run: |
@@ -41,7 +41,6 @@ jobs:
         continue-on-error: true
 
       - name: Upload Bandit SARIF
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: bandit-results.sarif