extension_rollout: Prevent dispatch from non-main branches (#49396)

Release Notes:

- N/A

.github/workflows/extension_workflow_rollout.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch: {}
 jobs:
   fetch_extension_repos:
+    if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions') && github.ref == 'refs/heads/main'
     runs-on: namespace-profile-2x4-ubuntu-2404
     steps:
     - id: list-repos

tooling/xtask/src/tasks/workflows/extension_workflow_rollout.rs

@@ -9,7 +9,7 @@ use crate::tasks::workflows::steps::CheckoutStep;
 use crate::tasks::workflows::{
     extension_bump::{RepositoryTarget, generate_token},
     runners,
-    steps::{self, NamedJob, named},
+    steps::{self, DEFAULT_REPOSITORY_OWNER_GUARD, NamedJob, named},
     vars::{self, StepOutput},
 };
 
@@ -59,6 +59,9 @@ fn fetch_extension_repos() -> NamedJob {
     let (get_org_repositories, list_repos_output) = get_repositories();
 
     let job = Job::default()
+        .cond(Expression::new(format!(
+            "{DEFAULT_REPOSITORY_OWNER_GUARD} && github.ref == 'refs/heads/main'"
+        )))
         .runs_on(runners::LINUX_SMALL)
         .timeout_minutes(5u32)
         .outputs([("repos".to_owned(), list_repos_output.to_string())])