ci: opt in to checkout v7 fork guard in workflow_run apply jobs (emdash-cms#1906)

actions/checkout v7 refuses to check out fork PR code from a
workflow_run workflow unless the step explicitly sets
allow-unsafe-pr-checkout: true. Since the v7 bump (emdash-cms#1611), every
"Query Counts — Apply" and "Auto Format — Apply" run that reaches the
fork checkout fails with "Refusing to check out fork pull request
code", so fork PRs no longer get snapshot updates or auto-formatting
pushed back.

Both jobs were already designed for this trust boundary: they never
execute code from the fork tree — they only apply inert artifacts
produced by the trusted measure/format runs (JSON copies, git apply)
and push with a scoped app token via GIT_ASKPASS, with
persist-credentials: false. Opt in explicitly and document why the
checkout is safe.

Author: swissky

.github/workflows/auto-format-apply.yml

@@ -149,6 +149,13 @@ jobs:
           repository: ${{ steps.pr.outputs.full_name }}
           ref: ${{ steps.pr.outputs.sha }}
           persist-credentials: false
+          # Reviewed opt-in to checkout v7's fork guard: no code from the
+          # fork tree is ever executed here. The steps below only `git apply`
+          # the patch from the trusted format artifact and run git
+          # add/commit/push — no scripts, hooks, or tooling from the
+          # checked-out tree. Credentials are not persisted; the push uses
+          # a scoped app token via GIT_ASKPASS.
+          allow-unsafe-pr-checkout: true
 
       - name: Apply patch
         if: steps.download.outputs.found == 'true'

.github/workflows/query-counts-apply.yml

@@ -154,6 +154,13 @@ jobs:
           repository: ${{ steps.pr.outputs.full_name }}
           ref: ${{ steps.pr.outputs.sha }}
           persist-credentials: false
+          # Reviewed opt-in to checkout v7's fork guard: no code from the
+          # fork tree is ever executed here. The steps below only copy the
+          # inert snapshot JSONs from the trusted measure artifact and run
+          # git add/commit/push — no scripts, hooks, or tooling from the
+          # checked-out tree. Credentials are not persisted; the push uses
+          # a scoped app token via GIT_ASKPASS.
+          allow-unsafe-pr-checkout: true
 
       - name: Apply snapshots
         if: steps.download.outputs.found == 'true'