ci(pr-title-lint): document pull_request_target safety

Add the security rationale comment (metadata-only; no PR-code checkout; title
read via env, not interpolated) matching the repo's other pull_request_target
workflows. Addresses review feedback.

Author: lml2468

.github/workflows/pr-title-lint.yml

@@ -1,6 +1,9 @@
 name: PR Title Lint
 
 on:
+  # pull_request_target: metadata-only automation — the reusable checks out NO PR
+  # code and reads the PR title via env (never interpolated), so fork PRs cannot
+  # execute code or inject via the title. zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, edited, reopened, synchronize]