generate-patch now emits a has-fixes job output (true/false). apply-patch is gated on it via `if: needs.generate-patch.outputs.has-fixes == 'true'`, so when `npm run fix` produces no diff, the privileged job is skipped entirely — no runner allocation, no redundant checkout/download/push/PR.