ci: skip CLA checks in forks

[Naohiro2g]

Summary

• skip the Signature Assistant job when the workflow is running in a fork
• preserve CLA checks for pull requests targeting Scratch Foundation repositories

Why

Forks do not receive the GHA_AGREEMENTS_PAT repository secret. When a pull request targets a fork itself, the copied workflow therefore attempts to run without the token required to write signatures to scratchfoundation/scratch-agreements and fails with a configuration error.

For pull requests targeting an upstream Scratch Foundation repository, github.event.repository is the upstream repository, so the CLA check continues to run unchanged.

Validation

• parsed .github/workflows/signature-assistant.yml with the yaml Node package
• ran git diff --check

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Naohiro2g]

I have read the CLA Document and I hereby sign the CLA