ci: prevent workflows from running on forks

[leezenn]

Summary

Forked repositories inherit GitHub Actions workflows including scheduled ones. This causes:

1. Wasted Actions minutes - Scheduled workflows run on forks even though they will fail
2. Failed runs - Workflows requiring CODEX_OPENAI_API_KEY fail immediately on forks
3. Noise - Fork owners see failed workflow runs they didn't trigger

This PR adds if: github.repository == 'openai/codex' guards to workflows that should only run on the upstream repository.

Affected workflows

Workflow	Trigger	Issue
rust-release-prepare	schedule: */4 hours	Runs 6x/day on every fork
close-stale-contributor-prs	schedule: daily	Runs daily on every fork
issue-deduplicator	issues: opened	Requires CODEX_OPENAI_API_KEY
issue-labeler	issues: opened	Requires CODEX_OPENAI_API_KEY

Note

cla.yml already has this guard (github.repository_owner == 'openai'), so it was not modified.

Test plan

• Verify workflows still run correctly on openai/codex
• Verify workflows are skipped on forks (can check via Actions tab on any fork)

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[leezenn]

I have read the CLA Document and I hereby sign the CLA

[leezenn]

Per the contributing guidelines, noting that this is a bug fix, not a feature request.

The current behavior causes unintended side effects on forks:

• Scheduled workflows consume fork owners' Actions minutes
• Workflows fail due to missing secrets (CODEX_OPENAI_API_KEY)
• Fork owners receive failure notifications for runs they didn't trigger

The cla.yml workflow already has this guard pattern (github.repository_owner == 'openai'), suggesting this was the intended behavior for fork-sensitive workflows.

[etraut-openai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[etraut-openai]

Fork maintainers can also modify workflows if they'd prefer, but this is a sensible change. Thanks for the contribution.