Add repository guards to deployment workflows (#877)

- Guard deploy-docs job to only run in canonical repository
- Guard goreleaser job to only run in canonical repository
- Guard update-homebrew job to only run in canonical repository
- Guard test-pypi job to only run in canonical repository

Prevents fork workflows from attempting to deploy, release, or publish to external services.

.github/workflows/deploy-docs.yml

@@ -83,6 +83,8 @@ jobs:
           path: website/build
 
   deploy:
+    # Guard: deploy should only run in the canonical repository (not in forks)
+    if: ${{ github.repository == 'steveyegge/beads' }}
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}