pub(crate) fn with_artifacts() -> bool
True only where the workflow decided this run may hold the artifacts key — master. A PR run builds and verifies everything with no credential mounted.