fix(ci): use pull_request_target for fork PR labeling (#479)

Switch trigger from pull_request to pull_request_target so fork PRs
get a write-capable GITHUB_TOKEN. Replace git-diff squad detection
with GitHub API (pulls.listFiles) since pull_request_target does not
check out fork commits. Remove unnecessary checkout step.

Closes #479

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: oalanicolas

.github/workflows/pr-labeling.yml

@@ -2,7 +2,7 @@ name: PR Labeling
 # Story 6.1 - Added concurrency
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize]
 
 concurrency:
@@ -16,34 +16,30 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
       - name: Label PR based on files changed
         uses: actions/labeler@v4
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           configuration-path: .github/labeler.yml
           sync-labels: true
 
-      - name: Check for squad changes
-        id: check-squad
-        run: |
-          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q "^squads/"; then
-            echo "has_squad=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_squad=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Add needs-po-review label for squad PRs
-        if: steps.check-squad.outputs.has_squad == 'true'
+      - name: Check for squad changes and add label
         uses: actions/github-script@v7
         with:
           script: |
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
+            const { data: files } = await github.rest.pulls.listFiles({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              labels: ['needs-po-review']
-            })
+              pull_number: context.payload.pull_request.number,
+              per_page: 100
+            });
+            const hasSquadChanges = files.some(f => f.filename.startsWith('squads/'));
+            if (hasSquadChanges) {
+              await github.rest.issues.addLabels({
+                issue_number: context.payload.pull_request.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                labels: ['needs-po-review']
+              });
+            }