add guidance on naming of fork branches

CONTRIBUTING.md

@@ -302,10 +302,11 @@ exposes our team and Canonical to operational risks.
 - PRs from forks should not be merged directly into the default branch if any of
   the CI/CD cannot be run (e.g., because it requires a secret). This is because
   there might be issues with the PR that are missed because certain checks did
-  not run. These PRs should be redirected to a separate branch and then have a
-  PR raised from that branch to the default branch. The branch protection of a
-  repo should not allow branches from forks to be merged directly into the
-  default branch.
+  not run. These PRs should be redirected to a separate branch (prefixed with
+  `fork-*`) and then have a PR raised from that branch to the default branch.
+  The PR should link to the original PR from the fork for reference. The branch
+  protection of a repo should not allow branches from forks to be merged
+  directly into the default branch.
 
 The above configuration ensures our team processes around changes are enforced
 and provides access to the repository even if some team members are unavailable.