Use event allowlists for live-provider CI isolation across PR targets
When GitHub Actions live-provider tests must never run on pull requests, use a positive allowed-event condition at every provider job boundary. A source/base branch exclusion protects only named branches: a different target can still receive Supabase, Microsoft Graph, or OpenAI c…