Skip privileged Pixi lockfile updates for fork PRs

[RonitBStudent]

Changes proposed in this pull request

• Run the privileged lockfile checkout/update job only for pull requests whose head branch is in this repository.
• Give fork pull requests a separate, no-permissions job that does not check out or execute fork code.
• Preserve the existing manual lockfile-update guidance for forks.

This intentionally does not set allow-unsafe-pr-checkout: true.

Related to #1630.

Documentation that should be reviewed

None; existing fork guidance in the README remains accurate.

Validation

• Parsed .github/workflows/pixi-lock.yml with PyYAML.
• Asserted the fork job has empty permissions, the privileged job requires a same-repository head, and no checkout step opts into unsafe fork checkout.
• Ran git diff --check.

[Copilot]

Pull request overview

This PR adjusts the pull_request_target lockfile workflow so only same-repository PRs run the privileged lockfile update job, while fork PRs get a separate “no permissions / no checkout” job that prints guidance instead. This fits the repo’s CI security posture by preventing privileged workflows from checking out or executing fork code.

Changes:

• Add a fork-only job (skip-fork-lockfile-update) with permissions: {} that emits manual lockfile update instructions.
• Gate the existing check-lockfile job so it runs only when the PR head repo matches the base repository.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.