Merge pull request #10527 from Roasbeef/fix-pr-severity-fork-prs

workflows/pr-severity: use pull_request_target for fork PRs

.github/workflows/pr-severity.yml

@@ -1,7 +1,10 @@
 name: PR Severity Classification
 
 on:
-  pull_request:
+  # Use pull_request_target to allow running on fork PRs with access to secrets.
+  # This is safe because we don't checkout or execute any code from the PR -
+  # we only read PR metadata (changed files, labels) via the GitHub API.
+  pull_request_target:
     types: [opened, synchronize, labeled]
 
 permissions: