fix(ci): limit the fingerprint shortcut to branches of this repository

The duplicate check accepted any open PR whose head branch started with
the dedupe prefix and ended in the fingerprint of the fresh proposal. The
listing also returns PRs from forks, and the fingerprint can be derived
from public data, so a fork PR with such a branch name would have made the
bot skip its own update PR without carrying the change.

The shortcut now only applies to PRs whose head branch lives in this
repository, which only accounts with write access can create. A fork PR
is still compared by the content of its head, as before.

Raised by the CodeRabbit review of PR #781.

Refs #780

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

scripts/github/update/open/pr.sh

@@ -70,8 +70,8 @@ mapfile -t OPEN_PRS < <(
 		--state open \
 		--base "${UPDATE_BASE_BRANCH}" \
 		--limit 100 \
-		--json number,headRefName \
-		--jq ".[] | select(.headRefName | startswith(\"${UPDATE_DEDUPE_PREFIX}\")) | \"\(.number)\t\(.headRefName)\""
+		--json number,headRefName,isCrossRepository \
+		--jq ".[] | select(.headRefName | startswith(\"${UPDATE_DEDUPE_PREFIX}\")) | \"\(.number)\t\(.isCrossRepository)\t\(.headRefName)\""
 )
 
 DUPLICATE_PR=""
@@ -79,7 +79,9 @@ for entry in "${OPEN_PRS[@]}"; do
 	[[ -z "${entry}" ]] && continue
 	pr_num="${entry%%$'\t'*}"
 	pr_branch="${entry##*$'\t'}"
-	if [[ "${pr_branch}" == *"-${LOCAL_FP:0:7}" ]]; then
+	pr_cross_repo="${entry#*$'\t'}"
+	pr_cross_repo="${pr_cross_repo%%$'\t'*}"
+	if [[ "${pr_cross_repo}" == "false" && "${pr_branch}" == *"-${LOCAL_FP:0:7}" ]]; then
 		echo "  open PR #${pr_num} (${pr_branch}): branch name carries this fingerprint"
 		DUPLICATE_PR="${pr_num}"
 		break