ci: don't run repo-specific workflows on forks

Guard release, publish, wiki-deploy and issue/PR-triage workflows with a
`github.repository` check so they no-op in forks instead of failing or
acting on the fork's own issues, PRs, tags and registries.

Also skip the Docker Scout scan for pull requests from forks: Docker Hub
secrets are never exposed there, so the login step could not succeed.

Tests and lint stay ungated — they need no secrets and are the gate for
incoming fork PRs.

.github/workflows/close-stale-invalid-titles.yml

@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   close-stale:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - name: Close stale invalid-title issues

.github/workflows/close-stale-wrong-branch.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   close-stale:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - name: Close stale wrong-base-branch PRs

.github/workflows/close-untitled-issues.yml

@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   check-title:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - name: Flag or redirect issue

.github/workflows/docker-dev.yml

@@ -18,6 +18,7 @@ concurrency:
 
 jobs:
   version-bump:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}

.github/workflows/docker.yml

@@ -33,6 +33,7 @@ concurrency:
 
 jobs:
   version-bump:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.bump.outputs.VERSION }}

.github/workflows/enforce-target-branch.yml

@@ -6,6 +6,7 @@ on:
 
 jobs:
   check-target:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write

.github/workflows/publish-plugin-sdk.yml

@@ -14,6 +14,7 @@ permissions:
 
 jobs:
   publish:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/security.yml

@@ -11,6 +11,9 @@ permissions:
 
 jobs:
   scout:
+    # Docker Hub secrets are not exposed to pull requests from forks, so the
+    # Scout login can never succeed there.
+    if: github.repository == 'mauriceboe/TREK' && github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/wiki.yml

@@ -17,6 +17,7 @@ concurrency:
 
 jobs:
   deploy:
+    if: github.repository == 'mauriceboe/TREK'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4