fix(ci): use pull_request_target for fork PR welcome comments

[cobusgreyling]

Fork PR workflows only get a read-only GITHUB_TOKEN on pull_request, so welcome comments 403'd (#141).

• Switch to pull_request_target (comment-only script, no checkout — safe)
• Skip if a maintainer welcome comment is already present
• Also run on synchronize so re-pushes re-check without duplicate comments

[github-actions]

Loop Readiness Audit

Score: 100/100 (L3)

Strong loop readiness — good candidate for L3 with explicit gates.

Top suggestions

• Create loop-constraints.md with denylist paths, push/merge rules, and human gates (see templates/loop-constraints.md)

_{Posted by audit.yml · loop-audit docs}