Scope credentialed PR jobs by the destination branch

When one GitHub Actions workflow validates both staging and production, do not run both credentialed jobs on every pull request. Positively map the pull request base branch to exactly one GitHub environment and one provider environment, then execute only that matrix entry. This prevents a staging-bound change from reading production secrets or linking a CLI through production merely to inspect staging. Keep production validation on production-bound pull requests and release workflows. This controls authored workflow scope; it does not stop a malicious workflow edit unless trusted-base execution and branch protections also exist.

Applies when: Pull requests target multiple persistent environments with different provider credentials. Keywords: GitHub Actions environment secrets pull request base branch Railway staging production