Guard live-service pull request jobs at the job boundary

A pull request can activate workflows outside the changed component, including tests that use live service credentials. Before opening a review-only branch, inspect every pull-request workflow and place an exact source-branch condition on each job that could send external traffic. A step-level condition still starts a runner and can leave other steps active. Keep local validation jobs running, and treat skipped external jobs as isolation evidence rather than passing tests. Confirm the condition is evaluated from the pull request's merged workflow and does not alter intended manual runs.

Applies when: A review branch must produce CI evidence without exercising live services. Keywords: pull request workflow job guard synthetic traffic live credentials skipped checks branch