The pool selector is defense-in-depth only — pull_request executes the
PR's own workflow definition, so YAML cannot enforce runner trust. Make
the actual enforcement boundary explicit in the decision record:
org-side disabled forking (the public release is an isolated read-only
mirror under a separate org), with migration to a repo-restricted
org-level runner group with base-branch workflow pinning as a hard
gate before forking could ever be enabled.
f09539581d