ci(docs-preview): skip publish/comment steps on fork PRs

The docs-preview workflow runs on `pull_request`, where a fork's
GITHUB_TOKEN is read-only. The "Comment on PR with preview link" step then
fails with "Resource not accessible by integration", turning the check red
on every external contributor's PR even though the MkDocs build succeeded.

Guard the two write-requiring steps (www publish, PR comment) with
`if: github.event.pull_request.head.repo.full_name == github.repository`.
Fork PRs still run the build that validates the docs but skip the steps
needing write access, so the check stays green; internal branches publish
the preview as before.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/pdf-at-pr.yaml

@@ -50,7 +50,12 @@ jobs:
         working-directory: documentation
         run: mkdocs build --clean
 
+      # Publishing the preview and commenting need a writable GITHUB_TOKEN,
+      # which pull_request from a fork does not get (token is read-only there).
+      # Skip these steps for fork PRs so the check stays green after the build
+      # step has already validated the docs; internal branches still publish.
       - name: Publish to `www` branch
+        if: github.event.pull_request.head.repo.full_name == github.repository
         working-directory: www
         run: |
           mkdir -p "${{ github.event.number }}"
@@ -62,6 +67,7 @@ jobs:
           git push origin www || true
 
       - name: Comment on PR with preview link
+        if: github.event.pull_request.head.repo.full_name == github.repository
         uses: devindford/Append_PR_Comment@v1.1.3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}