fix(ci): handle workflow_dispatch in fork PR permission checks

Inverted the condition logic to properly handle all event types:
- push → runs (not a pull_request)
- workflow_dispatch → runs (not a pull_request)
- pull_request from same repo → runs (fork check passes)
- pull_request from fork → skips (no write permissions)

The previous approach explicitly listed 'push' which missed workflow_dispatch.
The new approach skips only fork PRs, allowing all other events through.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Author: dcramer

.github/workflows/eval.yml

@@ -64,8 +64,8 @@ jobs:
 
       - name: Create eval status check
         uses: actions/github-script@v7
-        # Skip for fork PRs (no write permissions) but still run for pushes and same-repo PRs
-        if: ${{ !cancelled() && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        # Skip for fork PRs (no write permissions) but still run for pushes, workflow_dispatch, and same-repo PRs
+        if: ${{ !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true # Don't fail workflow if check creation fails
         with:
           script: |

.github/workflows/token-cost.yml

@@ -164,7 +164,7 @@ jobs:
       - name: Create check run
         uses: actions/github-script@v7
         # Skip for fork PRs (no write permissions) but still run for pushes and same-repo PRs
-        if: ${{ always() && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true # Don't fail workflow if check creation fails
         with:
           script: |