Add repository guards to deployment workflows (#877)

- Guard deploy-docs job to only run in canonical repository
- Guard goreleaser job to only run in canonical repository
- Guard update-homebrew job to only run in canonical repository
- Guard test-pypi job to only run in canonical repository

Prevents fork workflows from attempting to deploy, release, or publish to external services.

.github/workflows/release.yml

@@ -15,6 +15,8 @@ permissions:
 
 jobs:
   goreleaser:
+    # Guard: only run goreleaser in the canonical repository (not in forks)
+    if: ${{ github.repository == 'steveyegge/beads' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout