SECURITY FIX: Prevent PRs from pushing to container registry

Critical security vulnerability fixed in dev container prebuild workflow.

**Vulnerability:**
- Workflow was set to `push: always` for ALL events including PRs
- Any pull request (including from FORKS) could push to ghcr.io
- Malicious contributors could push compromised dev container images
- Could overwrite legitimate `latest` tag with malicious image

**Fix:**
- Changed push condition to: `github.event_name != 'pull_request'`
- PRs now build/test ONLY (push: never)
- Only these events can push:
  - Push to master branch
  - Manual workflow_dispatch
  - Scheduled weekly rebuilds
  - All require write access to repository

**Behavior Now:**
- ✅ PRs: Build and test image (validates Dockerfile changes)
- ✅ Master: Build, test, and push to registry
- ✅ Schedule: Build, test, and push to registry
- ✅ Manual: Build, test, and push to registry

**Additional Improvements:**
- Updated summary output to clearly indicate push status
- Added security warning for PR builds
- Makes it obvious when image was/wasn't pushed

This ensures only trusted maintainers with repository write access
can publish dev container images to the registry.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: claude

.github/workflows/devcontainer-prebuild.yml

@@ -46,7 +46,7 @@ jobs:
         with:
           imageName: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           cacheFrom: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          push: always
+          push: ${{ github.event_name != 'pull_request' && 'always' || 'never' }}
           imageTag: latest
 
       - name: Summary
@@ -58,7 +58,15 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Trigger:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Benefits:**" >> $GITHUB_STEP_SUMMARY
-          echo "- 🚀 Faster dev container startup (cached layers)" >> $GITHUB_STEP_SUMMARY
-          echo "- 📦 Consistent environment across all developers" >> $GITHUB_STEP_SUMMARY
-          echo "- ⚡ Weekly rebuilds keep dependencies fresh" >> $GITHUB_STEP_SUMMARY
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "**Status:** ✅ Build tested successfully (not pushed to registry)" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "⚠️ **Security Note:** PRs only build/test the image. Push to master to publish." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**Status:** ✅ Built and pushed to registry" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Benefits:**" >> $GITHUB_STEP_SUMMARY
+            echo "- 🚀 Faster dev container startup (cached layers)" >> $GITHUB_STEP_SUMMARY
+            echo "- 📦 Consistent environment across all developers" >> $GITHUB_STEP_SUMMARY
+            echo "- ⚡ Weekly rebuilds keep dependencies fresh" >> $GITHUB_STEP_SUMMARY
+          fi