Fix pipeline to not fail on PRs from forked repos

[nkutub]

Summary

Improves GitHub Actions behavior for pull requests from forks so CI fails for the right reasons (real test/lint failures) instead of infrastructure limits (checkout, OIDC/AWS, or misleading e2e failures).

Changes

OpenAPI workflow (ci-reporting-app-openapi.yml)

• Checkout uses github.event.pull_request.head.sha instead of github.head_ref, so the job can fetch the PR head when the branch exists only on the fork.
• Branch for git push: after SHA checkout (detached HEAD), run git checkout -B ${{ github.head_ref }} so the existing “commit + push OpenAPI updates” step still works for same-repo PRs.

PR environment + E2E (ci-reporting-app-pr-environment-checks.yml)

• Gate the reusable pr-environment-checks workflow (build → AWS → deploy PR env → e2e) so it runs only for:
  • workflow_dispatch, or
  • Same-repo pull_request (head.repo.full_name == github.repository) while the PR is open.
• Fork PRs skip that pipeline: GitHub does not grant id-token/OIDC for fork-originated pull_request workflows the same way, so AWS credentials and downstream e2e would fail regardless of code quality.
• fork-pr-skip-notice job: runs on open fork PRs only, succeeds with an Actions notice explaining why PR env + e2e were skipped and how to validate (merge, upstream branch, or manual dispatch).

Preview environment for reporting-app

• Service endpoint: https://p-376-reporting-app-dev-1509284871.us-east-1.elb.amazonaws.com
• Deployed commit: 699d562