ci: Fix automatic labeling for fork pull requests

[iMicknl]

Fork pull requests currently fail the Release Drafter autolabel check with Resource not accessible by integration: GitHub downgrades the pull_request token to read-only, preventing the action from applying labels (as seen in #2233).

Use pull_request_target and update the autolabel job condition so fork PRs can receive Conventional Commit labels. The job retains only contents: read and pull-requests: write, uses the existing SHA-pinned action, and does not check out or execute contributor code. Release drafting remains restricted to pushes to main.

Validation: all pre-commit checks passed, including actionlint, mypy, and ty; 556 tests passed. Pytest printed an unclosed client session message at shutdown. Live fork-event validation requires this workflow change to reach main, followed by a new PR event.

[Copilot]

🟢 Approval recommended

The narrowly scoped workflow change resolves fork labeling while retaining minimal permissions and avoiding untrusted code execution.

Pull request overview

Updates Release Drafter so fork pull requests can receive automatic Conventional Commit labels.

Changes:

• Uses pull_request_target for base-repository write permissions.
• Restricts the privileged job to labeling without contributor code execution.

File summaries

File	Description
.github/workflows/release-drafter.yml	Enables secure autolabeling for fork PRs.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.