Repo move: PR workflows fail under the github org's pull_request_target block #2407

The github org's Actions policy blocks pull_request_target. Since the transfer (2026-11-06 22:33Z), every pull_request_target run of these workflows ends in startup_failure with "Event 'pull_request_target' is not allowed to trigger Actions workflows" (for example, run 42305876712):

• squad-heartbeat.yml (the PR-closed trigger)
• squad-impact.yml
• squad-pr-readiness.yml
• squad-repo-health.yml

GitHub will also block pull_request_target by default in all public repositories on 2026-12-02 (changelog).

Fix: move each workflow to an untrusted pull_request part (read-only token, no secrets) plus a workflow_run writer that runs default-branch code, without weakening the trust boundary.

Follow-ups (outside this issue)

• The shipped template .squad-templates/workflows/squad-heartbeat.yml and gh-aw workflows/squad-review.md still use pull_request_target.
• Require code-owner review on dev.