ci(config): move auto-labeler to pull_request_target for fork PRs (#2188)

* test(cli): add dockerized sshd fixture for deploy SSH tests

Two openssh-server containers (ports 22022/22023) plus lifecycle
helpers. Deterministic test keypair committed to the repo for
reproducibility; no production value.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(cli): add deploy.yml fixtures for ConfigLoader tests

* feat(cli): add ProxyCommands with kamal-proxy hand-off

* ci(config): move auto-labeler to pull_request_target for fork prs

the `label` job in pr.yml uses the `pull_request` trigger, which github
forcibly issues a read-only GITHUB_TOKEN to for fork PRs — overriding the
workflow's `permissions: pull-requests: write` declaration.
`actions/labeler@v6` then fails with "Resource not accessible by
integration" on every fork PR (seen on #2167, #2172, #2180, #2183).

split the labeler into its own workflow triggered by `pull_request_target`,
which runs in the base repo's context and grants a write-scoped token even
for fork PRs. the remaining jobs (commitlint, tests) keep the safer
`pull_request` trigger since they execute checked-out PR code.

this is the pattern recommended by actions/labeler's docs for repos that
accept fork contributions. it's safe because the labeler never checks out
the fork's code — it only reads PR metadata and .github/labeler.yml from
the base branch via the API.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bpamiri

.github/workflows/label.yml

@@ -0,0 +1,25 @@
+name: Auto-Label PR
+
+# Uses pull_request_target so fork PRs receive a write-scoped GITHUB_TOKEN.
+# Safe: this workflow never checks out PR code — actions/labeler only reads
+# PR metadata and .github/labeler.yml from the base branch via the API.
+# No untrusted PR inputs (titles, bodies, branch names) are used in run steps,
+# so no workflow injection surface.
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+    branches:
+      - develop
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    name: Auto-Label PR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v6
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr.yml

@@ -7,22 +7,9 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
   checks: write
 
 jobs:
-  label:
-    name: Auto-Label PR
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/labeler@v6
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
   commitlint:
     name: Validate Commit Messages
     runs-on: ubuntu-latest