fix: make release dep check job always run on PRs

[stpierre]

What changed?

Always run the release dependency check job on all PRs. When the PR is not against a release branch, it gracefully degrades to a no-op.

Why?

This will let us make the status required, so that it can actually block releases that fail the job.

How did you test it?

• built
• run locally and tested manually
• covered by existing tests
• added new unit test(s)
• added new functional test(s)

[CLAassistant]

All committers have signed the CLA.

[semgrep-managed-scans]

Semgrep found 1 missing-explicit-permissions finding:

• .github/workflows/check-release-dependencies.yml
  • L7-56 - Triage

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

[tdyas]

Does the job still work as you intend if the if keys at the step level are moved to a single if key directly under check-dependencies? https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idif

[stpierre]

It would not; in that case, no job would run, and the status would be skipped. Github Actions requires a success status; skipped counts as failed. We need a job to run, it just doesn't have to actually do anything 🙄