compile-workflows: PR-only trigger, simplified checkout (#18)

The compile-workflows job was firing on both `pull_request` and `push`
to `main`, but compiling `.md` workflows on merge is redundant — the PR
run already commits the lock files back to the branch.

## Changes

- **Removed `push` trigger** — workflow now only runs on `pull_request`
events targeting `main`
- **Simplified checkout** — two conditional checkout steps (push vs PR)
collapsed into a single step using `github.head_ref`
- **Simplified `if:` guard** — no longer needs to check `event_name`,
just `head.repo.fork == false`

<!-- START COPILOT CODING AGENT TIPS -->
---

💬 We'd love your input! Share your thoughts on Copilot coding agent in
our [2 minute survey](https://gh.io/copilot-coding-agent-survey).

.github/workflows/code-review.md

@@ -30,6 +30,7 @@ safe-outputs:
 
 tools:
   github:
+    lockdown: true
     toolsets: [pull_requests, repos]
   bash: true
   web-fetch:

.github/workflows/compile-workflows.yaml

@@ -5,32 +5,26 @@ on:
     branches: ["main"]
     paths:
       - ".github/workflows/*.md"
-  push:
-    branches: ["main"]
-    paths:
-      - ".github/workflows/*.md"
 
 jobs:
   compile:
     name: Compile
     runs-on: ubuntu-latest
+    # Skip fork PRs: secrets are unavailable, and we should not compile
+    # untrusted .md content from a fork and push it back.
+    if: github.event.pull_request.head.repo.fork == false
+    permissions:
+      contents: read  # checkout; push uses GH_PAT explicitly
 
     steps:
-      - name: Checkout (push)
-        if: github.event_name == 'push'
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GH_PAT }}
-
-      - name: Checkout (PR head branch)
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT }}
 
       - name: Install gh-aw extension
-        run: gh extension install github/gh-aw
+        run: gh extension install github/gh-aw --version v0.50.7
         env:
           GH_TOKEN: ${{ secrets.GH_PAT }}