ci: skip report job for fork PRs to fix addComment 401

GITHUB_TOKEN is scoped read-only on fork PRs by GitHub security policy,
even when the workflow declares pull-requests/issues: write. This causes
the 'Post PR comment' step to fail with:

  GraphQL: Resource not accessible by integration (addComment)

Fix: gate the entire report job with:
  github.event.pull_request.head.repo.full_name == github.repository

Fork contributors still see all eval results in job logs + uploaded
artifacts. The comment only appears for maintainer PRs from the same repo
where GITHUB_TOKEN has the necessary write scope.

Ref: GitHub docs — 'Permissions for the GITHUB_TOKEN | Fork PRs'

.github/workflows/evals.yml

@@ -157,7 +157,13 @@ jobs:
   report:
     runs-on: ubicloud-standard-8
     needs: evals
-    if: always() && github.event_name == 'pull_request'
+    # Skip entirely for fork PRs: GITHUB_TOKEN is read-only on forks even with
+    # pull-requests/issues: write declared, so addComment always returns 401.
+    # Fork contributors still see all eval results in the job logs and artifacts.
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     timeout-minutes: 5
     permissions:
       contents: read