Generated from templates by gromit. Do not edit by hand.

The DHI customization providing the compiler toolchain is a private Docker Hub
repository, but the Docker Hub login was gated to non-pull_request events --
correct only while pull requests used the public debian:bookworm-slim fallback
that has now been removed. Every pull-request run would have failed in
"Resolve source base digest" with a 401.

The login now runs on pull requests too, and docker-build is skipped for pull
requests from a fork, where GitHub withholds the secrets needed to pull the
base at all.