Harden deploy workflow_run trust checks

[phillco]

Motivation

• Prevent privileged Deploy jobs from running on workflow_run events originating from untrusted sources by ensuring the upstream run was a push from the same repository before checking out workflow_run.head_sha.

Description

• Updated .github/workflows/deploy.yml to add if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }} to the publish-vscode-extension, publish-neovim-extension, and push-cursorless-talon jobs while preserving checkout pinning to workflow_run.head_sha.

Testing

• Ran pnpm run lint which completed successfully.

---

Codex Task