fix(ci): skip pending-maintainer label writes on fork PR review events (#1442)

pull_request_review runs triggered by fork PRs get a read-only
GITHUB_TOKEN, so the label add/remove calls fail with 403
"Resource not accessible by integration" (e.g. every review
submitted on #1440).

Guard the job: only handle pull_request_review when the PR head
repo is this repo. Fork PR labels stay eventually-consistent via
the hourly schedule / workflow_dispatch reconciliation, which runs
with a full token.

Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>

Author: chaodu-agent

.github/workflows/pending-maintainer.yml

@@ -11,7 +11,16 @@ on:
 
 jobs:
   check-pending:
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || github.event.issue.pull_request != null || github.event.pull_request != null
+    # Fork guard: pull_request_review on a fork PR gets a read-only GITHUB_TOKEN,
+    # so label writes would 403 ("Resource not accessible by integration").
+    # Skip those runs — the hourly schedule / workflow_dispatch reconciliation
+    # (full token) keeps fork PR labels correct.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'schedule' ||
+      github.event.issue.pull_request != null ||
+      (github.event.pull_request != null &&
+       github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write