ci(ai-validation): skip prepare on Mergify-authored PRs

Lifts the existing Mergify-author short-circuit (today inside validate's
`secrets-check` step) to a job-level `if:` on `prepare`, so the whole
pipeline skips for backport/queue PRs.

Why now: every Mergify backport whose merge ref shares no shallow
ancestor with the (advanced) base branch fails the prepare step at

  git diff "$BASE...HEAD" --name-only ...
  fatal: FETCH_HEAD...HEAD: no merge base

(because base is `git fetch --no-tags --depth=1` and the merge ref is
`fetch-depth: 2`). Proximate symptom: run 25842928620 on PR #2042
(sagitta backport of #2023). AI Validation isn't a required check so
the queue isn't blocked, but every Mergify backport is left with a red
"prepare" check that adds noise to PR review.

The validate-level skip in commit 0e8a2956 was correct for the
"claude-code-action rejects bot-initiated runs" failure mode but
fires too late — prepare has already run and crashed before validate's
`if: needs.prepare.outputs.has_md_changes == 'true'` even evaluates.

Implementation: single job-level `if:` on prepare. validate's
`needs: [prepare]` cascades the skip naturally (skipped needs make
the dependent's expression-based `if:` evaluate against empty outputs).
The in-step author check in validate stays as defense-in-depth.

🤖 Generated by [robots](https://vyos.io)

(cherry picked from commit 7d94d6116be1a4776b7317cb5190a83dd065e571)

1 files changed, 13 insertions, 0 deletions

diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml
index 8d22ddb1..58cd6c38 100644
--- a/.github/workflows/ai-validation.yml
+++ b/.github/workflows/ai-validation.yml
@@ -46,6 +46,19 @@ jobs:
   #   - GitHub-hosted runners are ephemeral — every run starts on a fresh
   #     VM, so cross-run state leakage is not possible.
   prepare:
+    # Skip the whole pipeline on Mergify-authored PRs (backport PRs, queue
+    # PRs). The underlying change was already reviewed on the source PR;
+    # re-running prepare wastes a runner and — for backports to branches
+    # that have advanced since the merge ref was computed — fails with
+    # `fatal: FETCH_HEAD...HEAD: no merge base` during the shallow-fetch
+    # diff step, leaving a red "prepare" check on every Mergify backport
+    # (proximate symptom: run 25842928620 on PR #2042, the sagitta
+    # backport of #2023). validate already short-circuits on bot authors
+    # via its `secrets-check` step, but that fires too late — guarding at
+    # the job level skips prepare entirely, and `needs: [prepare]` +
+    # `if: needs.prepare.outputs.has_md_changes == 'true'` cascades the
+    # skip to validate as well.
+    if: github.event.pull_request.user.login != 'mergify[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read