ci: fix ci.yml YAML and keep fork PRs off the self-hosted runner

[RFingAdam]

The self-hosted runner sweep (732d731, 2026-09-09) replaced the test job's os: matrix and runs-on: ${{ matrix.os }} with a bare [self-hosted, Linux, X64, haven] line that has no runs-on: key. That makes ci.yml invalid YAML (could not find expected ':' at line 72), so GitHub rejects the whole workflow at startup and no CI job has run since.

Changes

• ci.yml, test job: [self-hosted, Linux, X64, haven] becomes runs-on: [self-hosted, Linux, X64, haven].
• ci.yml, job name Test (${{ matrix.os }} / py...) becomes Test (py${{ matrix.python-version }}), since there is no os matrix any more.
• ci.yml, coverage upload: if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13' becomes if: matrix.python-version == '3.13'. With matrix.os gone the old condition was always false, so coverage would never have uploaded.
• Fork guard (separate commit): this repo is public and its jobs run on a self-hosted runner on the homelab network. Fixing ci.yml would let fork pull requests run their code there, so every job in ci.yml and the build job in docs.yml now has if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository. Pushes and same-repo branches still run, but fork PRs are skipped. The docs.yml deploy job is already gated by github.ref == 'refs/heads/main' and needs: build, so it never runs for a PR and is left alone.

release.yml still uses matrix.os, but there it comes from a real include: matrix (multi-OS wheel builds triggered by tags or manual dispatch, not PRs), so it is valid and left alone.

Checked

• yaml.safe_load fails on main (line 72) and passes on this branch for ci.yml and docs.yml. The parsed if: and runs-on: values are as intended for every job.
• actionlint 1.7.7: on main it reports the syntax error. On this branch the only findings for ci.yml and docs.yml are "unknown label haven", and both files are clean with haven declared as a self-hosted label.

Still blocked after merge: no runner registered
This repo has no self-hosted runner registered (GET /repos/RFingAdam/lineforge/actions/runners returns total_count: 0), and hosted runners do not start on this account. Valid workflows will sit in the queue until a haven runner is registered to this repo. That includes docs.yml, which builds and deploys the GitHub Pages docs site, so the published docs will not update either.