QVAC-23467 infra: skip publish-sdk compile on pull_request_target

[opaninakuffo]

🎯 What problem does this PR solve?

• publish-sdk.yml runs on pull_request_target and checks out base.sha (main), then bun install + bun run build typecheck @qvac/sdk against npm @qvac/inference. Main's SDK source already uses types that published inference does not export, so the job is red on any PR that touches packages/sdk/**, packages/inference/**, packages/bare-sdk/**, or packages/sdk-python/**.
• That compile is not a PR-head check. SDK Pod Checks workspace-link in-repo inference. Editing this workflow in the failing PR cannot green the current run, because pull_request_target always uses the YAML from main.
• Blocks merge for PRs such as QVAC-23467 doc: point Bare consumers at @qvac/inference #4018 / QVAC-23467 chore: drop @qvac/bare-sdk from the lockstep pipeline #4019 when the merge flow rejects any red CI.

📝 How does it solve it?

• On pull_request_target, keep checkout + lockstep version verify. Skip bun install/compile/artifact upload in build, and skip build-bare-sdk / build-inference (they need the skipped dist).
• Push and workflow_dispatch still compile and publish as before.

🧪 How was it tested?

• YAML review only. This PR does not match publish-sdk.yml path filters, so the broken compile job should not run here.
• After merge: empty-commit or synchronize QVAC-23467 doc: point Bare consumers at @qvac/inference #4018 so pull_request_target picks up this workflow from main; Build and Publish QVAC SDK / build should pass on lockstep verify alone.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[github-actions]

License compliance — clean

No new dependency license findings in this PR.

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[github-actions]

Workflow security (shadow mode)

zizmor found 1096 finding(s) in .github/ (highest severity: high). This check is warn-only and does not block the merge.

Findings are annotated inline on the changed files and listed in the job summary.

Reproduce locally:

pipx run zizmor==1.27.0 --offline .github/