ci: skip scheduled workflows on forks and fix the Windows sandbox W0 lane (#6016)

Eight workflows with a cron trigger had no repository guard, so every fork
with Actions enabled ran them nightly against its own, usually stale, main.
On a fork they fail for reasons unrelated to the change under test: the
dependency audit flags advisories already fixed upstream, and the Windows
release check downloads its upgrade baseline from the fork's own releases,
which do not exist.

Gate each job on `github.event_name != 'schedule' || github.repository ==
'apache/maka'`. Pull request, push and manual dispatch runs keep their
current behavior, including on forks; only cron runs outside apache/maka are
skipped. issue-pr-lifecycle and model-metadata-upkeep already guard on the
repository, and npm-publication is gated by NPM_NIGHTLY_ENABLED.

Generated-by: Claude Code
fix(runtime): emit the filesystem worker bundle as .mjs

The worker bundle was emitted as dist/workers/filesystem-worker.js, so
Node walked up to the nearest package.json to decide the module type.
Inside the Windows AppContainer sandbox that read is denied, and the
worker crashed at launch with ERR_INVALID_PACKAGE_CONFIG. The
windows_sandbox_w0_protocol job has failed on main because of it.

An .mjs bundle is ESM by extension, so Node never performs the lookup.
The build and desktop copy scripts now take the file name from
FILESYSTEM_WORKER_BUNDLE_NAME so the producer cannot drift from the
resolver; packaging verifiers keep literal paths because they check the
shipped layout independently.

Split out of #5969, which carries the same rename.

Generated-by: Claude Code
fix(release): accept the legacy worker name in Windows upgrade baselines

The pinned-version upgrade check verifies the previously released installer
with the current resource list, which now demands
`workers/filesystem-worker.mjs`. Releases built before the rename ship
`filesystem-worker.js`, so the check failed on bytes that were correct when
they shipped. Relax the requirement for the upgrade-baseline contract, like
the other resources that newer builds added.

Generated-by: Claude Code

Author: Astro-Han

.github/workflows/dependency-audit.yml

@@ -51,6 +51,7 @@ concurrency:
 
 jobs:
   audit:
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:

.github/workflows/pr-effort-label.yml

@@ -46,6 +46,7 @@ concurrency:
 
 jobs:
   label:
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
 

.github/workflows/release-linux-check.yml

@@ -83,6 +83,7 @@ jobs:
   # Not `package`: the Windows lane's job already claims that name, and two
   # checks reading `package` on the same pull request cannot be told apart.
   package-linux:
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     # x64 only. The arm64 packages are built from the same scripts, the same
     # configuration and the same descriptor, so this lane would re-prove all of
     # what it can reach and none of what differs — a 16K-page host and its own

.github/workflows/release-windows-check.yml

@@ -124,6 +124,7 @@ concurrency:
 
 jobs:
   package:
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: windows-2025
     timeout-minutes: 45
     defaults:

.github/workflows/windows-acp.yml

@@ -45,6 +45,7 @@ concurrency:
 jobs:
   windows_acp:
     name: windows_acp
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: windows-2025
     timeout-minutes: 45
     steps:

.github/workflows/windows-baseline.yml

@@ -36,6 +36,7 @@ permissions:
 jobs:
   windows_baseline:
     name: windows_baseline (non-blocking)
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: windows-latest
     timeout-minutes: 45
     continue-on-error: true

.github/workflows/windows-recovery.yml

@@ -162,6 +162,7 @@ permissions:
 jobs:
   windows_recovery:
     name: windows_recovery
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: windows-latest
     timeout-minutes: 45
     steps:

.github/workflows/windows-sandbox-w0.yml

@@ -47,6 +47,7 @@ concurrency:
 jobs:
   protocol:
     name: windows_sandbox_w0_protocol
+    if: github.event_name != 'schedule' || github.repository == 'apache/maka'
     runs-on: windows-2025
     timeout-minutes: 45
     steps:

apps/desktop/electron-builder.config.mjs

@@ -132,8 +132,8 @@ const baseDesktopBuilderConfig = {
       to: 'status',
     },
     {
-      from: 'resources/workers/filesystem-worker.js',
-      to: 'workers/filesystem-worker.js',
+      from: 'resources/workers/filesystem-worker.mjs',
+      to: 'workers/filesystem-worker.mjs',
     },
     {
       from: '../../native/runtime-host-peer/target/release/maka_runtime_host_peer.node',

apps/desktop/scripts/copy-runtime-filesystem-worker.mjs

@@ -20,10 +20,11 @@
 import { copyFile, mkdir, stat } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { FILESYSTEM_WORKER_BUNDLE_NAME } from '../../../packages/runtime/dist/filesystem-worker/resource-resolver.js';
 
 const desktopRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const source = resolve(desktopRoot, '..', '..', 'packages', 'runtime', 'dist', 'workers', 'filesystem-worker.js');
-const target = resolve(desktopRoot, 'resources', 'workers', 'filesystem-worker.js');
+const source = resolve(desktopRoot, '..', '..', 'packages', 'runtime', 'dist', 'workers', FILESYSTEM_WORKER_BUNDLE_NAME);
+const target = resolve(desktopRoot, 'resources', 'workers', FILESYSTEM_WORKER_BUNDLE_NAME);
 const metadata = await stat(source).catch(() => undefined);
 if (!metadata?.isFile()) throw new Error(`Runtime filesystem worker bundle is missing: ${source}`);
 await mkdir(dirname(target), { recursive: true });