GitHub does not expose repository secrets to workflow runs triggered by
pull_request from a fork, so VELXIO_BUILD_LICENSE_KEY arrives empty and
the download step's `[ -z ] && exit 1` guard hard-fails every external
contributor's PR for a reason unrelated to their change (e.g. #220 from
ciegovolador, the buzzer audio fix, which only touches frontend).
Add a lightweight `gate` job that checks whether the key is present and
gates the real `e2e` job on it (needs + if). Fork PRs now SKIP e2e
(neutral) instead of going red; maintainer pushes and same-repo branches,
which do receive the secret, still run the full simulation suite.
98b0df7d93