* build(github): check that the "close" job only runs when the appropriate label is applied
it follows that the "build" job would only have built an environment when the label was applied
* build(github): check that the action is run directly on the repository and not from a fork
this alleviates the problem that the deploymentToken for Azure only exists within the repository
be3a1759de