Guard the dispatch jobs against forks, not the lint

titanium-sdk carried `github.repository_owner == 'tidev'` and the module repos
did not -- an inherited asymmetry, not a decision. Worse, this branch had it on
the wrong job: once notify stopped depending on lint, guarding lint stopped
guarding anything. A fork would skip the one job that is useful there and still
run both dispatch jobs, which fail because a fork holds no dispatch token.

The guard now sits on the two jobs that reach outside the repo, in all 17 repos.
Forks lint their own apidoc changes, which is worth having, and produce no
failing dispatch runs.

It is about noise, not security. A fork has no REGEN_DOCS_GITHUB_TOKEN, and even
with one the payload names the fork, which is not on titanium-www's allowlist --
that allowlist is the actual boundary.

Author: cb1kenobi

.github/workflows/regen-docs.yml

@@ -42,10 +42,12 @@ jobs:
   # ti.coremotion cannot run `npm ci` at all today because its lockfile is out of
   # sync with its package.json. Genuinely malformed apidoc still cannot ship: the
   # compile in titanium-www fails on it and commits nothing.
-  #
-  # Skipped on pull_request: a proposed change gets linted, not published.
   notify:
-    if: github.event_name != 'pull_request'
+    # Skipped on pull_request: a proposed change gets linted, not published.
+    # Skipped in forks: they hold no dispatch token, so this would only ever
+    # produce a failing run. The allowlist in titanium-www is the actual
+    # boundary -- a fork's payload names the fork, which is not on it.
+    if: github.event_name != 'pull_request' && github.repository_owner == 'tidev'
     uses: tidev/titanium-www/.github/workflows/notify-api-docs.yml@main
     secrets:
       dispatch-token: ${{ secrets.REGEN_DOCS_GITHUB_TOKEN }}
@@ -57,7 +59,11 @@ jobs:
   #
   # Delete this job once titaniumsdk.com is served from titanium-www (TI-52).
   notify-legacy:
-    if: github.event_name != 'pull_request'
+    # Skipped on pull_request: a proposed change gets linted, not published.
+    # Skipped in forks: they hold no dispatch token, so this would only ever
+    # produce a failing run. The allowlist in titanium-www is the actual
+    # boundary -- a fork's payload names the fork, which is not on it.
+    if: github.event_name != 'pull_request' && github.repository_owner == 'tidev'
     runs-on: ubuntu-latest
     name: Notify titanium-docs (legacy)
     steps: