hygiene: prepare ForgeFlow for public release

.gitea/workflows/managed-validation.yml

@@ -21,6 +21,8 @@ concurrency:
 jobs:
   full:
     name: full
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps: