ci: fix GHA cache permissions and guard cache-to for fork PRs

[Copilot]

type=gha cache in build-release-smoke was missing the required actions: write permission, and cache-to was unconditionally set — causing failures on fork PRs where the token cannot be granted write access.

Changes

• Permissions: Added permissions: contents: read + actions: write to build-release-smoke job
• Fork guard: Extracted cache scope into CACHE_SCOPE env var and set IS_FORK from github.event.pull_request.head.repo.full_name != github.repository; cache-to is only populated for non-fork PRs:

cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
cache-to: ${{ env.IS_FORK == 'false' && format('type=gha,mode=max,scope={0}', env.CACHE_SCOPE) || '' }}

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[plexoos]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Updates the pull-request CI workflow to make GitHub Actions cache usage reliable by explicitly granting the needed permissions and preventing cache writes when the workflow runs for forked pull requests (where the token cannot have write access).

Changes:

• Add explicit job-level permissions for build-release-smoke to enable type=gha cache writes.
• Introduce CACHE_SCOPE and IS_FORK environment variables to centralize cache scoping and detect fork PRs.
• Guard cache-to so it is only set for non-fork pull requests, avoiding failures on forks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.