CI: workflows that need repo secrets fail on every fork sync (tests-main, build_documentation, deploy_*)

### System Info

CI only, no PEFT install involved. `main` @ `0e8d0ae8`.

### Who can help?

@BenjaminBossan @githubnemo

### Reproduction

Fork the repo and sync `main` from upstream (e.g. the "Sync fork" button). Four workflows fire on the push and all fail, because they need repository secrets that only exist in `huggingface/peft`:

| Workflow | Fails at | Example run on my fork |
|---|---|---|
| `tests-main.yml` | `Post to Slack`: `Need to provide at least one botToken or webhookUrl` (after ~20 min of tests) | https://github.com/Ayushraj06-bit/peft/actions/runs/34709151181 |
| `build_documentation.yml` | `Input required and not supplied: token` (`HUGGINGFACE_PUSH`) | https://github.com/Ayushraj06-bit/peft/actions/runs/34709151582 |
| `deploy_peft_shop_app.yml` | `git push -f gradio-app`: `could not read Username for 'https://huggingface.co'` | https://github.com/Ayushraj06-bit/peft/actions/runs/34709151254 |
| `deploy_method_comparison_app.yml` | same as above | https://github.com/Ayushraj06-bit/peft/actions/runs/34709151223 |

The same thing happened on every earlier sync (e.g. https://github.com/Ayushraj06-bit/peft/actions/runs/33611881724, https://github.com/Ayushraj06-bit/peft/actions/runs/33609144025). `stale.yml` and `triage_prs.yml` already avoid this with `if: github.repository == 'huggingface/peft'`; the four workflows above don't have that guard.

### Expected behavior

On a fork these jobs should be skipped rather than fail, and `tests-main.yml` should not spend 20 minutes of runner time before failing. Proposed fix: add the same `if: github.repository == 'huggingface/peft'` guard to the four jobs (one line each, four files). `tests.yml` would stay as is, since running the regular tests on a fork is useful.

I have this ready on a branch (with the two dispatchable deploy workflows verified as `skipped` on my fork) and would like to open the PR if you approve.

Unrelated observation, not part of this proposal: `trufflehog.yml` triggers on every push, so the first push of a new branch on a fork scans the whole history (empty `BASE`) and fails on ~29 unverified hits; it also does not run on `pull_request`, so fork PRs are never scanned. Happy to open a separate issue if that is of interest.

Start by comparing the existing repository guard in .github/workflows/stale.yml and triage_prs.yml with tests-main.yml, build_documentation.yml, deploy_peft_shop_app.yml, and deploy_method_comparison_app.yml. Verify on a fork that the secret-dependent jobs are skipped without consuming the test runtime, while tests.yml continues to run normally.

Written by the indexing model from the issue text.