Scope credentialed PR jobs by the destination branch
When one GitHub Actions workflow validates both staging and production, do not run both credentialed jobs on every pull request. Positively map the pull request base branch to exactly one GitHub environment and one provider environment, then execute only that matrix entry. This p…