fix: skip docs build/publish on pull_request, not just push (#222)

## Summary

The \`sphinx\` job in \`master.yml\` runs unconditionally on every
trigger -- \`push\` (merge to master/future) *and* \`pull_request\`. On
a PR whose branch lives in a fork -- including the author's own fork
(this is what happened on #198) -- the job's final \"push to gh-pages\"
step always fails:

\`\`\`
remote: Permission to rai-opensource/spatialmath-python.git denied to
github-actions[bot].
fatal: unable to access '...': The requested URL returned error: 403
\`\`\`

This is GitHub Actions' own security policy: \`GITHUB_TOKEN\` is
hardcoded read-only for \`pull_request\`-triggered runs whenever the
head repo differs from the base repo, regardless of any repo/workflow
permission settings. Not a bug in this repo, not fixable by changing
settings -- the fix is to simply not attempt the gh-pages publish during
PR runs at all, which is also the right behaviour independent of the
permission issue (unreviewed PR content shouldn't land on the live
public docs site).

## What's changed

- \`master.yml\`: added \`if: \${{ github.event_name != 'pull_request'
}}\` to the \`sphinx\` job, so it (and the whole reusable \`sphinx.yml\`
workflow it calls) is skipped entirely on PR runs, and only runs on
\`push\`.
- \`sphinx.yml\`: removed a dead, commented-out attempt at this exact
guard (\`# if: \${{ github.event_name != 'pull_request' }}\`). It could
never have worked there -- \`sphinx.yml\` is invoked via
\`workflow_call\`, and \`github.event_name\` inside a called workflow is
always \`\"workflow_call\"\`, never the original triggering event. The
condition has to live on the caller job (in \`master.yml\`), which does
see the real event.

## Side benefit

PR runs no longer spend ~10+ minutes building docs that were never going
to be published anyway.

## Test plan

- [x] Both edited YAML files parse as valid YAML
- [x] Traced the actual failure to this cause via #198's CI log and
GitHub's documented \`GITHUB_TOKEN\` permissions for fork-originated
\`pull_request\` events
- Can't locally simulate GitHub's \`workflow_call\` event-name
substitution, but the fix follows GitHub's own documented behaviour and
this is a pure \`if:\`-condition change with no other logic touched

Author: petercorke

.github/workflows/master.yml

@@ -77,6 +77,12 @@ jobs:
         file: ./coverage.xml
   sphinx:
     # If the above worked:
-    # Build docs and upload to GH Pages
+    # Build docs and upload to GH Pages -- only on push (merge to master/future),
+    # never on pull_request: a PR whose branch lives in a fork (including the
+    # author's own fork) gets a read-only GITHUB_TOKEN by GitHub's own design,
+    # so the gh-pages push step always fails there regardless of repo settings.
+    # Publishing unreviewed PR content to the live docs site isn't desired
+    # either way.
     needs: unittest
+    if: ${{ github.event_name != 'pull_request' }}
     uses: ./.github/workflows/sphinx.yml

.github/workflows/sphinx.yml

@@ -6,7 +6,6 @@ on:
 jobs:
   sphinx:
     runs-on: ubuntu-22.04
-    # if: ${{ github.event_name != 'pull_request' }}
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python 3.12