[CI] E2E PR tests fail: missing GH_TOKEN and fork checkout blocked #153

Summary

PR E2E tests (.github/workflows/test-pr.yml) fail or stall for two reasons:

1. actions/checkout@v7 blocks fork PR checkouts in pull_request_target workflows (regression from Bump actions/checkout from 6 to 7 #138).
2. GH_TOKEN is unavailable until the e2e-test environment is approved and GH_PAT / GH_PAT_UBUNTU secrets are exposed.

Fork PRs fail at Checkout:

Refusing to check out fork pull request code from a 'pull_request_target' workflow.
Set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

Example: https://github.com/git-mastery/app/actions/runs/31790555307 (PR #151)

Other PRs stay in waiting until e2e-test is approved, or fail at Validate GH_TOKEN:

Required PAT secret is missing for <os>.

Examples: https://github.com/git-mastery/app/actions/runs/31891526601, https://github.com/git-mastery/app/actions/runs/31676896074

Same-repo PRs can pass once approved (e.g. https://github.com/git-mastery/app/actions/runs/31891985306).

Expected

PR E2E tests run reliably for fork and same-repo PRs, with clear feedback when approval or secrets are missing.

Possible fixes

• Handle fork checkouts safely under pull_request_target (e.g. conditional allow-unsafe-pr-checkout, or split trusted/untrusted jobs).
• Ensure GH_PAT / GH_PAT_UBUNTU are configured for e2e-test and document maintainer approval in CONTRIBUTING.md.