ci: prevent upstream release jobs from running in the fork

[pilprod]

Summary

Restrict every publishing job in the upstream tag workflow to kagent-dev/kagent.

The maintained pilprod/kagent fork is an evaluated source input and does not own a release lifecycle. Tag pushes or manual dispatches in the fork now skip image, chart, Python package, and GitHub release publication.

Validation

• Parsed every workflow YAML file.
• git diff --check passed.
• No image, chart, package, tag, or release was created.

[pilprod]

Validation note: the guarded workflow is tag/manual-release scoped and intentionally does not run for pull requests. All touched workflow YAML parses successfully, git diff --check passes, and the remote diff contains only repository-identity guards. This PR remains draft; no image, chart, package, tag, or GitHub release was created.