chore(CI): enhance PR workflows with trusted PR check and permission adjustments

[UnschooledGamer]

No description provided.

[greptile-apps]

Greptile Summary

This PR updates the preview-release workflows for PR handling. The main changes are:

• Adds a trusted-PR input to the reusable nightly build.
• Passes only the required signing/build secrets to the reusable workflow.
• Lowers the caller workflow contents permission to read.
• Moves preview success comments from the reusable workflow to the caller workflow.

Confidence Score: 4/5

The fork PR preview path can fail during cleanup after skipping signing/build file creation.

• The new trusted-PR condition prevents the secret files from being written for fork PRs.
• The later cleanup still assumes those files exist.
• The permission and comment changes look consistent with the jobs that use them.

.github/workflows/nightly-build.yml

Important Files Changed

Filename	Overview
.github/workflows/nightly-build.yml	Adds required workflow-call secrets and skips writing signing/build files for untrusted PRs, but leaves cleanup assuming those files exist.
.github/workflows/on-demand-preview-releases-PR.yml	Adjusts permissions, passes explicit secrets, sends the trusted-PR flag, and handles preview status comments in the caller workflow.

_{Reviews (1): Last reviewed commit: "feat: add required secrets for keystore ..." | Re-trigger Greptile}