fix(ci): skip e2e docker push and e2e tests for fork PRs

Fork PRs receive a read-only GITHUB_TOKEN that cannot push images to
the org's GHCR package registry. Pass push: false for fork PRs so the
docker build still validates compilation, but skip the push and e2e
test jobs which require the pushed images.

Author: johntmyers

.github/workflows/branch-e2e.yml

@@ -16,6 +16,8 @@ jobs:
       component: gateway
       platform: linux/arm64
       runner: build-arm64
+      # Fork PRs cannot push to the org's GHCR — build-only to validate.
+      push: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
 
   build-cluster:
     if: contains(github.event.pull_request.labels.*.name, 'test:e2e')
@@ -24,8 +26,11 @@ jobs:
       component: cluster
       platform: linux/arm64
       runner: build-arm64
+      push: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
 
   e2e:
+    # E2e tests need the pushed images, so they can only run for internal PRs.
+    if: github.event.pull_request.head.repo.full_name == github.repository
     needs: [build-gateway, build-cluster]
     uses: ./.github/workflows/e2e-test.yml
     with: