fix(workflow): use pull_request_target for plot-review

- Runs workflow from base branch (plot/*) not PR head
- Ensures latest workflow version is used
- Checkout PR head sha for actual code review

Author: MarkusNeusinger

.github/workflows/plot-review.yml

@@ -5,7 +5,9 @@ run-name: "Review: ${{ github.event.pull_request.head.ref }}"
 # Reviews the implementation quality using AI
 
 on:
-  pull_request:
+  # Use pull_request_target to run from base branch (has secrets access)
+  # This ensures we use the latest workflow version from main/plot/* branch
+  pull_request_target:
     types: [opened, synchronize]
     branches:
       - 'plot/**'  # PRs targeting feature branches
@@ -39,9 +41,11 @@ jobs:
 
           echo "::notice::PR #$PR_NUMBER for $LIBRARY implementation of $SPEC_ID"
 
-      - name: Checkout code
+      - name: Checkout PR code
         uses: actions/checkout@v6
         with:
+          # Checkout PR head to review the actual implementation
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Get main issue number from PR