Exclude fork PRs from Gemini dispatch (consistency with hardened template)

[scalvela]

What

Add the && github.event.pull_request.head.repo.fork == false guard to the pull_request
branch of the dispatch job's if condition in .github/workflows/gemini-dispatch.yml.

Why

The equivalent Gemini dispatch workflows in GoogleCloudPlatform/vertex-ai-creative-studio
and GoogleCloudPlatform/gemini-cloud-assist-mcp (and the google-github-actions/run-gemini-cli
reference) gate the pull_request path on head.repo.fork == false. This workflow omitted it,
so it auto-dispatches the Gemini review agent on fork PRs.

Note on impact (not a security fix)

This trigger is pull_request (not pull_request_target), so fork PRs already run without
secrets or a write token — there is no secret-exposure issue here today. This is a
hardening / consistency change, not a security fix. It:

1. avoids spinning up the review agent on untrusted fork PRs, and
2. guards against a future switch to a pull_request_target trigger (which would pass secrets).

Change

       (
-        github.event_name == 'pull_request'
+        github.event_name == 'pull_request' &&
+        github.event.pull_request.head.repo.fork == false
       ) || (

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.