A GitHub Actions secret scan starts failing only forked pull requests

Internal runs pass, yet forks fail because the job evaluates secret-protected steps before it proves the event has access to those secrets.