fix(ci): use pull_request_target for fork PR reviews

Switch both review workflows from pull_request to pull_request_target
so they run with base repo permissions and can access secrets when
reviewing fork PRs.

Changes:
- claude-code-review.yml: pull_request → pull_request_target
- opencode-review.yml: pull_request → pull_request_target
- Both now explicitly checkout PR head commit for review
- Added security comments explaining the approach

This allows the workflows to run successfully after maintainer approval
for external contributor PRs.

.github/workflows/opencode-review.yml

@@ -1,7 +1,10 @@
 name: OpenCode PR Review
 
 on:
-  pull_request:
+  # Using pull_request_target to run with base repo permissions (access to secrets)
+  # This allows the workflow to run for fork PRs after maintainer approval
+  # Security: This workflow only READS PR code for review, it does NOT execute it
+  pull_request_target:
     types: [opened, synchronize]
     # Skip review for documentation and config-only changes
     # Exclude this workflow file to prevent self-triggering loops
@@ -35,13 +38,15 @@ jobs:
           total=$((additions + deletions))
           echo "total=$total" >> $GITHUB_OUTPUT
 
-      - name: Checkout repository
+      - name: Checkout PR code for review
         # Only review substantial changes (5+ files OR 20+ lines changed)
         if: |
           github.event.pull_request.changed_files >= 5 ||
           steps.calc.outputs.total >= 20
         uses: actions/checkout@v6
         with:
+          # Checkout the PR head commit (pull_request_target defaults to base branch)
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
           persist-credentials: false