fixup! Do not require approval for CI commits on main

Author: Murderlon

.github/workflows/ci.yml

@@ -64,7 +64,7 @@ jobs:
     # SECURITY: Use environment protection for external contributors only
     # Push events and internal PRs run without environment protection
     # External PRs require manual approval via 'external-testing' environment
-    environment: ${{ (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && '' || 'external-testing' }}
+    environment: ${{ github.event_name == 'push' && '' || (github.event.pull_request.head.repo.full_name == github.repository && '' || 'external-testing') }}
     # Run tests with secrets for:
     # 1. Push to main (trusted), OR
     # 2. PR from same repository (trusted), OR