feat(ci): restore fork pull request support - #428

Summary

Restores the fork pull request workflow changes from #416 after they were reverted by #422 while end-to-end testing was incomplete.

• recognize generated signature commits only when their paths, title, and verified GitHub identity match policy
• require validation evidence at or after the generated signature commit
• bound required-status polling
• skip redundant signature-push dispatch when no dispatch secret is available
• give fork contributors service-account onboarding guidance

Dependencies

Keep this draft until both backend changes are ready:

• NVIDIA/nvskills-ci#60
• nvcarps-ci!201

Verification

• resulting workflow files are byte-identical to the reviewed feat(ci): support fork pull requests #416 tree
• YAML parses successfully
• embedded Bash passes bash -n
• git diff --check passes
• smoke PR: NVIDIA/nvskills-ci-test#18
• central workflow run: https://github.com/NVIDIA/nvskills-ci/actions/runs/31162315218
• downstream pipeline: https://gitlab-master.nvidia.com/nvcarps/ci-group/nvcarps-ci/-/pipelines/61541473
• generated signature commit: 3d3429c03ac275f894ed822a6cffc73451aa4b29
• all validators, the content gate, report publication, signing, generated-signature verification, GitHub push, and required-status resolution passed

Test-environment note

The initial /nvskills-ci caller resolved the requester and PR context, but its cross-repository dispatch returned HTTP 403 because the NVIDIA/nvskills-ci-test repository's stored NVSKILLS_CI_DISPATCH_TOKEN is stale or under-scoped. I reran the exact payload with current authenticated access to complete the backend smoke test. The same stale secret also leaves the optional signature-push request job red; the authoritative NVSkills CI status and required-status check are green on the generated head commit. Refresh that test-repository secret before the final exact comment-path smoke test.