Harden Translations Export workflow for forked PRs without secrets

[Copilot]

The Export Translations job was failing on fork-based PRs because actions/create-github-app-token requires a private key secret that is not available in that context. This change makes the workflow fork-aware so it no longer fails at token generation while still enforcing translation consistency.

• Auth flow: gate GitHub App token usage

  • Skip create-github-app-token when the event is a forked pull_request.
  • Keep existing GitHub App auth path for non-fork runs where secrets are available.

• Checkout token fallback

  • Use app token when present; otherwise fall back to ${{ github.token }} for checkout.

• Push behavior: restrict to contexts that can write

  • Run auto commit/push only when changes exist and the PR is not from a fork.

• Fork PR enforcement

  • If translation export produces diffs on a fork PR, fail with a clear message instructing contributors to run npm run translations-export and commit generated files locally.

- name: Generate GitHub App Token
  if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false

- name: Checkout Repository
  with:
    token: ${{ steps.app-token.outputs.token != '' && steps.app-token.outputs.token || github.token }}

- name: Commit and Push Changes
  if: steps.check-changes.outputs.has_changes == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)