flake8 Lint workflow fails on fork PRs due to reviewdog 401

[labradorite-dev]

The flake8 Lint CI check fails on PRs from forks with:

reviewdog: failed to create check: POST https://api.github.com/repos/.../check-runs: 401 Bad credentials []

Cause: reviewdog/action-flake8 requires write access to the Checks API, but GITHUB_TOKEN on pull_request events from forks is read-only (GitHub docs, reviewdog/reviewdog#1179).

Example: PR #585 lint run

Possible fixes:

• Use pull_request_target trigger, which grants the token write permissions even for fork PRs
• Grant contributors push access so PRs come from branches, not forks