Use event allowlists for live-provider CI isolation across PR targets

When GitHub Actions live-provider tests must never run on pull requests, use a positive allowed-event condition at every provider job boundary. A source/base branch exclusion protects only named branches: a different target can still receive Supabase, Microsoft Graph, or OpenAI credentials. Preserve offline PR validation and explicitly permitted manual runs, then test parsed workflow conditions across target branches, fork contexts, PR actions, secret scopes, and called workflows. This controls authored CI behavior; it is not immutable security against a PR changing its own workflow, nor proof that unrelated build jobs lack credentials.

Applies when: automatic PR validation must avoid live provider test traffic across all target branches. Keywords: GitHub Actions pull_request workflow_dispatch Supabase Graph OpenAI credentials branch guard