chore: improve external contributor CI flow

.github/pull_request_template.md

@@ -11,16 +11,26 @@ Fixes `Issue URL`
 > [!WARNING]  
 > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._
 
-## Automation
+## Testing
 
-/ok-to-test tags=""
+> [!NOTE]
+> **How CI runs on fork PRs — no action needed from you.**
+> 1. **Workflow approval.** GitHub holds the first run on fork PRs until a maintainer approves it, so a pause before any check appears is expected.
+> 2. **Credential-free checks.** Once approved, format, lint, typecheck, unit tests, cyclic-dependency and compile-only build checks run without repository secrets. Only the checks relevant to what you changed (client / server / RTS) will run, and their logs are safe to debug against.
+> 3. **Maintainer-triggered checks.** Cypress, Playwright, Docker builds and deploy previews need secrets, so a maintainer starts them with `/approve-ci`, and `/build-deploy-preview` when hands-on testing is needed. Approval is pinned to one commit — pushing again requires fresh approval.
+>
+> The `awaiting-maintainer` / `awaiting-contributor` labels show whose turn it is. You do **not** need `ok-to-test` or any slash command. Full detail: [Pull request check states](https://github.com/appsmithorg/appsmith/blob/release/contributions/CodeContributionsGuidelines.md#pull-request-check-states).
+
+Select the validation relevant to this change:
 
-### :mag: Cypress test results
-<!-- This is an auto-generated comment: Cypress test results  -->
-> [!CAUTION]  
-> If you modify the content in this section, you are likely to disrupt the CI result for your PR.
+- [ ] Client unit tests
+- [ ] Server unit tests
+- [ ] Cypress
+- [ ] Playwright
+- [ ] Deploy preview
+- [ ] Not applicable
 
-<!-- end of auto-generated comment: Cypress test results  -->
+Suggested Cypress tags or specs:
 
 
 ## Communication

.github/workflows/build-chromatic.yml

@@ -14,6 +14,9 @@ on:
 
 jobs:
   chromatic-deployment:
+    # Internal PRs only: the Chromatic project token is not available to fork
+    # PRs, so this job would always fail for external contributors.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
 
     steps: