Self-review of the scope-gap paragraph added one commit earlier. It said both publish jobs carry
`if: github.event_name != 'pull_request'`. Measured: only `docker-build.yml::build` does.
`ci-image.yml` declares triggers `push`, `schedule` and `workflow_dispatch` — no `pull_request` at
all — so its job is never CREATED on a PR rather than being created and skipped.
The conclusion the paragraph draws is unchanged (PR CI cannot exercise the job-level env scope),
but the two mechanisms are worth keeping straight: an `if:`-skipped job is still dispatched as a
runner task, which is the behaviour #535 was about, while a job whose workflow has no matching
trigger produces no task at all.
Refs #786
timothy
64d80e5d28