ci: ignore SQLFluff annotate failures on fork PRs

Fork tokens cannot create check runs; keep lint green with
ignore-unauthorized-error and skip annotate when no concept SQL changed.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Chessing234

.github/workflows/lint_sqlfluff.yml

@@ -1,11 +1,16 @@
 name: SQLFluff
 
+# Lints changed mimic-iv/concepts/*.sql on pull requests and posts GitHub
+# annotations. permissions + ignore-unauthorized-error keep fork PRs usable.
 on:
   - pull_request
 
 jobs:
   lint-mimic-iv:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
     steps:
       - name: checkout
         uses: actions/checkout@v7
@@ -35,8 +40,10 @@ jobs:
         shell: bash
         run: sqlfluff lint --format github-annotation --annotation-level failure --nofail ${{ steps.get_files_to_lint.outputs.lintees }} > annotations.json
       - name: Annotate
+        if: steps.get_files_to_lint.outputs.lintees != ''
         uses: yuzutech/annotations-action@v0.6.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           title: "SQLFluff Lint"
-          input: "./annotations.json"
+          input: "./annotations.json"
+          ignore-unauthorized-error: true