translation github action fix

[Jared-dz]

Summary

• Every Auto-translate run since 2026-03-31 has failed at the final git push step — main is branch-protected (GH013: Changes must be made through a pull request), so the bot can't push translations directly. Four PRs of doc edits (Add OPS Management contributor documentation #164, subscribe branch #168, Update Edge Subscriber Connection.md #169, add api/ips to docs #170) merged without their translations.
• Switches the trigger from push: main to pull_request, so translations land inside the same PR as the English changes and never touch the protected branch.
• Adds a concurrency group, a fork-PR guard, and a loop guard that works for pull_request events (the old head_commit.author check is null on PR events).

What changed in .github/workflows/translate.yml

• Trigger: push: main → pull_request (opened, synchronize, reopened) on docs/**.md
• Checkout: ref: ${{ github.head_ref }} + fetch-depth: 0 to access the PR base SHA
• Diff base: HEAD~1 → ${{ github.event.pull_request.base.sha }}
• Loop guard: github.event.head_commit.author.name → github.actor
• Added: github.event.pull_request.head.repo.full_name == github.repository to skip fork PRs (secrets aren't exposed there)
• Added: concurrency: { group: translate-${{ github.head_ref }}, cancel-in-progress: true }
• Final step pushes to HEAD:${{ github.head_ref }} instead of main

scripts/translate.py is unchanged — it's already env-driven.

Test plan

The workflow's paths: filter is docs/**.md, so this PR won't trigger it. After merge, the first real test is the next PR that touches a doc file.

• Merge this PR
• Open a follow-up PR with a one-line edit to any docs/*.md file
• Confirm the "Auto-translate docs" check runs (~7 min for 1 source file × 7 languages)
• Confirm a chore: auto-translate docs commit by github-actions[bot] lands on the PR branch with the .zh/.ja/.ko/.pt/.es/.fr/.it files
• Confirm the bot's commit does NOT re-trigger the workflow (gh run list --workflow=translate.yml should show only one run for the PR)
• Push a second commit within ~30s and confirm the first run is cancelled (concurrency)

Out of scope

• Backlog: architecture.md (stale translations) and contribute-ops-management.md (no translations) will self-heal next time someone edits them.
• No workflow_dispatch manual trigger added — can be retrofitted later if catch-up becomes painful.
• Fork PRs are skipped, not supported via pull_request_target (security risk for an internal docs repo).