SW-106 — Add `pull_request_target` prohibition regression check

[dDevAhmed]

Summary

Add a static regression check preventing pull_request_target from entering repository workflows.

Acceptance Criteria

• current workflows pass;
• fixture using pull_request_target fails;
• no workflow permissions are expanded;
• repository checks pass.

Dependencies

• SW-105

---

🏷 Labels

• Stellar Wave
• type: security
• area: ci
• priority: P0
• difficulty: medium
• points: 150
• workstream: ci
• supply-chain
• protected-surface