Add repository guards to deployment workflows (#877)

- Guard deploy-docs job to only run in canonical repository
- Guard goreleaser job to only run in canonical repository
- Guard update-homebrew job to only run in canonical repository
- Guard test-pypi job to only run in canonical repository

Prevents fork workflows from attempting to deploy, release, or publish to external services.

.github/workflows/test-pypi.yml

@@ -5,6 +5,8 @@ on:
 
 jobs:
   test-publish:
+    # Guard: only allow test PyPI publish runs in the canonical repository
+    if: ${{ github.repository == 'steveyegge/beads' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout