ci: gate downstream PR runs on branch name containing downstream

Replace the run-downstream label with a head branch filter so forks
without shared labels still opt in (e.g. downstream-driver). Pull
requests still target main only.

Co-authored-by: Cursor AI <ai@cursor.sh>
Co-authored-by: Composer <composer@cursor.com>

Author: 3 people

.github/workflows/downstream.yml

@@ -1,6 +1,6 @@
-# Downstream checks are opt-in on pull requests (label: run-downstream) or fully
-# manual via workflow_dispatch. For dispatch-only runs: Actions → downstream → Run
-# workflow → pick a branch under "Use workflow from".
+# Downstream checks run on pull requests to main when the head branch name
+# contains "downstream", or any time via workflow_dispatch. For dispatch-only
+# runs: Actions → downstream → Run workflow → pick a branch under "Use workflow from".
 #
 # The workflow must exist on the default branch for it to appear under the
 # upstream repo's Actions tab; until the workflow is merged, use the fork's
@@ -10,7 +10,8 @@ name: downstream
 on:
   workflow_dispatch:
   pull_request:
-    types: [labeled, synchronize]
+    branches:
+      - main
 
 permissions: {}
 
@@ -23,17 +24,9 @@ jobs:
     name: downstream (${{ matrix.recipe }})
     runs-on: ubuntu-latest
     timeout-minutes: 120
-    # No default runs: add label "run-downstream" to the PR, or use workflow_dispatch.
     if: >-
       github.event_name == 'workflow_dispatch'
-      || (
-        github.event_name == 'pull_request'
-        && contains(github.event.pull_request.labels.*.name, 'run-downstream')
-        && (
-          github.event.action == 'synchronize'
-          || (github.event.action == 'labeled' && github.event.label.name == 'run-downstream')
-        )
-      )
+      || (github.event_name == 'pull_request' && contains(github.head_ref, 'downstream'))
     strategy:
       fail-fast: false
       matrix: