ci: run fresh-install workflows only in the upstream repo - #353

Summary

Gate every job in ci-fresh-install.yml and ci-aarch64-fresh-install.yml with github.repository == 'mcpp-community/mcpp', so the scheduled runs never execute in forks.

Why

Both workflows have schedule triggers:

• ci-fresh-install.yml: daily cron (0 6 * * *)
• ci-aarch64-fresh-install.yml: weekly Monday cron (0 6 * * 1)

GitHub runs schedule-triggered workflows on the repository's default branch and is not affected by the branches: [main] filters used by the push/pull_request triggers. A fork that renames its default branch (e.g. main → fork-main to stop push CI) still gets the cron executing on the renamed branch — wasting the fork's Actions quota and showing failing runs (fresh-install only tests released mcpp, so it provides zero value on a fork). Observed on a fork on 2026年08月03日 (both workflows) and 2026年08月04日 (daily one), all triggered by schedule, with no sync/push involved.

The workflow_run: [release] trigger is unaffected: it already fires only in the upstream repo, and the repository guard makes the schedule/manual/release paths no-ops on forks.

Impact on upstream

Identical behavior: all jobs still run on every upstream trigger (release → workflow_run, manual, daily/weekly schedule). PRs against upstream are unaffected — they run the self-host suites (ci-linux / ci-macos / ci-windows), which are untouched.

Test plan

• YAML syntax validated (both files parse cleanly)
• Upstream cron still runs as before
• Forks no longer execute these workflows on schedule