fix(ci): gate can-i-deploy broker steps individually, not at job level

The `env` context is not available in a job-level `if:` (only `github`/`needs`/
`vars`/`inputs` are), so `if: ... && env.PACT_BROKER != ''` on the job was an
invalid-context error that failed the whole workflow to parse. Move the broker
guard onto each step (matching the consumer/provider jobs) and keep the job
`if` on the master-branch check only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/pact.yml

@@ -130,12 +130,13 @@ jobs:
     name: can-i-deploy
     runs-on: ubuntu-latest
     needs: [consumer, provider]
-    # Gate on the broker secret too: the pact-broker CLI errors on an empty
+    # Only the `github` context is available in a job-level `if`, so the broker
-    # --broker-base-url, so without this guard a secret rotation/fork would
+    # guard lives on each step below (the pact-broker CLI errors on an empty
-    # break every master merge.
+    # --broker-base-url, e.g. after a secret rotation or on a fork).
-    if: ${{ github.ref == 'refs/heads/master' && env.PACT_BROKER != '' }}
+    if: ${{ github.ref == 'refs/heads/master' }}
     steps:
       - name: Join tailnet
+        if: ${{ env.PACT_BROKER != '' }}
         uses: tailscale/github-action@6cae46e2d796f265265cfcf628b72a32b4d7cade # v3
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
@@ -143,11 +144,13 @@ jobs:
           tags: tag:github-runner
 
       - name: Install Pact CLI
+        if: ${{ env.PACT_BROKER != '' }}
         run: |
           curl -fsSL https://raw.githubusercontent.com/pact-foundation/pact-ruby-standalone/f03e620e7552239b6ca59438c9beed9d1038c949/install.sh | bash # v2.6.1
           echo "$PWD/pact/bin" >> "$GITHUB_PATH"
 
       - name: Can I deploy nextcloud-mcp-server?
+        if: ${{ env.PACT_BROKER != '' }}
         run: |
           pact-broker can-i-deploy \
             --broker-base-url "$PACT_BROKER" \