fix(ci): add fork guard to CI-gated approval job

Reject fork PRs from auto-approval by checking
workflow_run.head_repository.full_name matches the current repository.
Aligns with the existing fork protection posture.
Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

Author: nullvariant

.github/workflows/justice-bot.yml

@@ -292,10 +292,12 @@ jobs:
   ci-gated-approve:
     name: 👮 CI-Gated Approval
     runs-on: ubuntu-latest
+    # SECURITY: Reject fork PRs — only same-repo branches are trusted for auto-approval.
     if: >
       github.event_name == 'workflow_run' &&
       github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
     permissions:
       contents: read
       pull-requests: write