ci: do not fail Forge skipped-status on fork-token 403

.github/workflows/ci-e2e.yml

@@ -67,9 +67,12 @@ jobs:
        github.event.issue.pull_request != null &&
        contains(github.event.comment.body, '/retest')) ||
       (github.event_name == 'pull_request' &&
-       (github.event.action != 'labeled'   || github.event.label.name == 'retest') &&
+       (github.event.action != 'labeled' ||
+        github.event.label.name == 'retest' ||
+        github.event.label.name == 'skip-e2e-test') &&
        (github.event.action != 'unlabeled' || github.event.label.name == 'skip-e2e-test'))
-    runs-on: Hyperloom-e2e-ci
+    # GitHub API + jq only. Keep Hyperloom-e2e-ci for the smoke job.
+    runs-on: ubuntu-latest
     outputs:
       run: ${{ steps.decide.outputs.run }}
       pr_number: ${{ steps.decide.outputs.pr_number }}

.github/workflows/forge-e2e.yml

@@ -207,12 +207,34 @@ jobs:
           else
             description="skipped: no Forge-related files changed"
           fi
-          curl -fsS -X POST \
+          # Fork pull_request jobs get a read-only GITHUB_TOKEN even with
+          # permissions.statuses: write, so this POST 403s and used to fail
+          # the required skipped-status check. Swallow only that 403;
+          # other HTTP / curl failures still fail the job. ci-e2e/kernelforge
+          # is often already SUCCESS (posted by a write-capable actor). A
+          # pull_request_target or workflow_run trigger would get a real
+          # write token — see the PR that introduced this fallback.
+          body="${RUNNER_TEMP:-/tmp}/skipped-status-body.json"
+          http_code="$(curl -sS -o "$body" -w '%{http_code}' -X POST \
             -H "Authorization: Bearer $GH_TOKEN" \
             -H "Accept: application/vnd.github+json" \
             "$API_URL/repos/$REPO/statuses/$SHA" \
             -d "$(jq -n --arg d "$description" \
-              '{state:"success", context:"ci-e2e/kernelforge", description:$d}')"
+              '{state:"success", context:"ci-e2e/kernelforge", description:$d}')" \
+            || true)"
+          case "$http_code" in
+            200|201)
+              echo "posted ci-e2e/kernelforge success"
+              ;;
+            403)
+              echo "status POST not permitted from a fork token (HTTP 403); continuing"
+              ;;
+            *)
+              echo "status POST failed HTTP=${http_code:-curl-error}" >&2
+              cat "$body" >&2 || true
+              exit 1
+              ;;
+          esac
 
   e2e:
     needs: resolve