Fix cron workflows to skip forks and fix pre-commit permissions

[blink1073]

References

N/A

Description

Prevent scheduled (cron) workflow runs from executing on forked repositories, and fix the pre-commit autoupdate workflow's push permissions.

Changes

• Add if: github.event_name != 'schedule' || github.repository == 'Calysto/metakernel' guard to all cron-triggered jobs across four workflows (tests, release, codeql, pre-commit-autoupdate)
• Fix pre-commit autoupdate workflow to use a GitHub App token for checkout and PR creation, resolving 403 permission errors on push
• Allow test_release job to be skipped in the tests_check alls-green gate

Backwards-incompatible changes

None

Testing

N/A — CI workflow changes only

AI usage

• Some or all of the content of this PR was generated by AI.
• The human author has carefully reviewed this PR and run this code.
• AI tools and models used: Claude Code (claude-opus-4-6)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.30%. Comparing base (85d284d) to head (4e96271).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #415   +/-   ##
=======================================
  Coverage   90.30%   90.30%           
=======================================
  Files          51       51           
  Lines        2950     2950           
  Branches      414      414           
=======================================
  Hits         2664     2664           
  Misses        209      209           
  Partials       77       77           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.