Security Fix: Prevent Fork PR Arbitrary Code Execution

TLDR: Add fork safety gate to prevent CRITICAL ACE vulnerability (OPSTK-16743, OPSTK-16732 Finding 1).

Vulnerability:

• Workflow runs on pull_request events with contents: write permission AND uses: ./ (local action execution)
• This allows fork PRs to execute arbitrary code with write access to the repository

Fix:
Add conditional gate to the git-auto-commit job:

if: github.event.pull_request.head.repo.full_name == github.repository

This ensures the job only runs on internal PRs (same repo), not fork PRs.

Risk Assessment:

• Fix class: workflow-yml-change
• Risk: medium
• Action: comment-only per Ops Stack security policy (no direct push to master)
• Paths modified: .github/workflows/git-auto-commit.yml

Testing:

• Fork PR: Job will be skipped (safe)
• Internal PR: Job runs normally (no behavior change)

References:

• Jira: OPSTK-16743 (this ticket)
• Parent: OPSTK-16732 (GitHub Actions security umbrella)
• STE: OPSTK-16733 (source finding)

Automated fix by Winton (opstk-cicd-auth GitHub App) on behalf of OPSTK-16743.
Human review required before merge.