Suggested test: copilot/push-to-pull-request-branch-fork-rejection

## Motivation

Link to the gh-aw PR: github/gh-aw#56341 — "Fix safe-output updates for fork pull request branches"

Adds fork-authorization checks to `push_to_pull_request_branch`: the trusted PR head repository is now recorded and forwarded through the MCP gateway; pushes to a contributor-fork branch are rejected during the agent's safe-output call unless `head-repo` explicitly authorizes the fork, even if a PAT has write access. The agent is instructed to report proposed code via `add_comment`/`report_incomplete` instead of retrying.

## Proposed test

- **Workflow file**: `test-copilot-siderepo-push-to-pull-request-branch-fork-rejection.md`
- **Trigger**: `workflow_dispatch` (existing siderepo fixtures don't model a true fork, so this may need feasibility triage)
- **Engine**: copilot
- **Safe output**: `push-to-pull-request-branch`
- **Variant**: siderepo (or note if infeasible without a real fork fixture)

## Minimal test prompt sketch

Attempt to push to a PR branch whose head repo is an unauthorized fork (not matching configured `head-repo`), and confirm the safe-output rejects the push and the agent falls back to `add_comment`/`report_incomplete` rather than erroring the whole run.

## New fixtures or secrets needed

Likely needs a genuine fork relationship (e.g. a fork of `githubnext/gh-aw-test` or `gh-aw-side-repo`) to open a real fork-originated PR — this may not be achievable with current fixtures and needs triage before converting to a PR.

## Notes

Overlaps conceptually with existing `test-copilot-*-push-to-pull-request-branch*` tests, but none currently exercise the fork-rejection path. Two currently-failing siderepo push-to-pull-request-branch tests exist in fails.txt but are unrelated (dispatch-based, not fork-based) — this is a distinct scenario.

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/33170338931) · copilot · auto · 22.6 AIC · ⌖ 3.81 AIC · ⊞ 8.8K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start with the proposed workflow file test-copilot-siderepo-push-to-pull-request-branch-fork-rejection.md and compare existing test-copilot-*-push-to-pull-request-branch* tests. Check whether current siderepo fixtures can represent a genuine fork relationship before choosing workflow_dispatch or documenting infeasibility. Done means the test confirms unauthorized fork pushes are rejected and the agent falls back to add_comment/report_incomplete without failing the run.

Written by the indexing model from the issue text.