* ci: update GitHub Actions to Node 24 * ci: skip privileged previews for forks * ci: isolate preview deployment secrets