Maestro (local): skip the lane on pull requests from forks

Secrets are never exposed to pull_request runs from forks, so checkEnv.js
throws on MAESTRO_PASSWORD after a full APK build and emulator boot, and the
red check is indistinguishable from a real test failure. The existing guard
checked github.event.pull_request.fork, a field that does not exist on the
pull_request payload (it lives at head.repo.fork), so it was always true.

Gate both jobs at job level on head.repo.full_name == github.repository
(workflow_dispatch still runs), and drop the dead step-level condition.

Fixes #7653

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/maestro-local.yml

@@ -20,6 +20,9 @@ jobs:
   build-apk:
     name: Build APK
     runs-on: ubuntu-latest
+    # Secrets are not available to pull_request runs from forks, so the Maestro job below
+    # cannot run for them; skip the build too, as its only consumer is that job.
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     concurrency:
       group: ${{ format('maestro-build-{0}', github.ref) }}
       cancel-in-progress: true
@@ -73,13 +76,13 @@ jobs:
     name: Maestro test suite
     runs-on: ubuntu-latest
     needs: [ build-apk ]
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     # Allow only one to run at a time, since they use the same environment.
     # Otherwise, tests running in parallel can break each other.
     concurrency:
       group: maestro-test
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        if: (github.event_name == 'pull_request' && github.event.pull_request.fork == null) || github.event_name == 'workflow_dispatch'
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881