fix(ci): skip Datadog reporting steps on non-main branches

Forked PRs lack id-token:write permissions required by dd-sts-action,
causing the "Get Datadog credentials" step to fail. Gate all DD CI
reporting steps (STS credentials, test optimization, orchestrion,
coverage upload) to only run on main. Tests still run on all PRs via
the existing plain `go test` fallback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: platinummonkey

.github/workflows/ci.yml

@@ -41,19 +41,22 @@ jobs:
           cache: true
 
       - name: Get Datadog credentials
+        if: github.ref == 'refs/heads/main'
         id: dd-sts # Needed to be able to reference this step's output later
         uses: DataDog/dd-sts-action@main # Pin to the main branch to get auto updates for free, or to a specific commit hash if you want stability
         with:
           policy: public-datadog-pup-sts
 
       - name: Configure Datadog Test Optimization
+        if: github.ref == 'refs/heads/main'
         uses: datadog/test-visibility-github-action@v2
         with:
           languages: go
           api_key: ${{ steps.dd-sts.outputs.api_key }}
           site: datadoghq.com
 
       - name: Install Datadog CI tools
+        if: github.ref == 'refs/heads/main'
         run: |
           # Install orchestrion for Go test instrumentation
           go install github.com/DataDog/orchestrion@latest
@@ -117,7 +120,7 @@ jobs:
           go tool cover -func=coverage.out | tail -1 >> coverage_report.txt
 
       - name: Upload coverage to Datadog
-        if: env.DD_API_KEY != ''
+        if: github.ref == 'refs/heads/main'
         env:
           DATADOG_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
           DD_SITE: datadoghq.com