ci: run the test suite on external PRs into main

[Rome-1]

The comprehensive suite only triggered on pull_request into prod, so contributor PRs targeting main merged with no automated verification at all — #215, #216 and #218 each sat MERGEABLE with an empty status-check rollup, and the last workflow run in the repo was 2026-07-29. Tests only ran later, at release time, when main was promoted to prod.

What changed

• main added to the pull_request trigger.
• A gate job decides who gets the suite; the 8 existing jobs depend on it.

Policy, per request:

PR	Suite runs?
into prod (release gate)	always — unchanged
into main from a fork / outside contributor	yes
into main authored by Rome-1	no
into main from a branch in the Raftersecurity repo	no

Our own work is reviewed and tested locally before it's pushed, so re-running the full matrix would only burn runner minutes.

Security notes

• Uses pull_request, not pull_request_target — fork PRs run with a read-only token and no access to secrets. There's a comment in the file saying so, because "fixing" that is the classic way to hand a fork repo-write credentials.
• The gate reads PR fields through env: rather than interpolating ${{ }} straight into the shell script, so nothing attacker-controlled reaches the command line.
• Fork PRs can't read secrets.RAFTER_API_KEY. The tests that need it already skip when it's absent (backend-api.test.ts skips by design; the local suite passes with 9 skips), so an external PR gets a clean green rather than a spurious failure.

Verification

YAML parses; all 8 jobs carry needs: gate + the if condition. This PR is itself from a Raftersecurity branch, so by its own policy the suite will skip on it — I'll confirm the workflow still runs end-to-end with a workflow_dispatch once it's on main.

🤖 Generated with Claude Code