Add repository guards to deployment workflows (#877)

- Guard deploy-docs job to only run in canonical repository
- Guard goreleaser job to only run in canonical repository
- Guard update-homebrew job to only run in canonical repository
- Guard test-pypi job to only run in canonical repository

Prevents fork workflows from attempting to deploy, release, or publish to external services.

.github/workflows/update-homebrew.yml

@@ -14,6 +14,8 @@ permissions:
 
 jobs:
   update-formula:
+    # Guard: only run homebrew update in the canonical repository (not in forks)
+    if: ${{ github.repository == 'steveyegge/beads' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout beads repo