ci: warm BuildKit cache on trusted pull requests

[jelias2]

Summary

Enable GitHub Actions BuildKit cache exports for same-repository pull requests. Fork PRs remain excluded.

Why

The reusable workflow already restores type=gha cache for every build, but only protected branches exported new cache entries. Dependency-changing PRs could not warm their own cache, so later pushes repeated expensive container compilation.

Change

• Replace the protected-branch condition with is_fork_pr == false in build and Bake modes.
• Preserve cache isolation by image name and platform.
• Keep cache export disabled for forks.

Validation

• Ruby YAML parse: passed
• Diff whitespace check: passed

Rollout

Consumers pinned to this reusable workflow need a follow-up SHA bump after this merges. The paired op-rbuilder PR documents that dependency.