Fork pull request validation cannot read required secrets and the pipeline fails for the wrong reason

The workflow itself is healthy, but pull_request runs from forks cannot access the same secret path as internal branches, causing misleading failures in preview jobs.