[BUG] Fix: Resolve checkout failure in auto-format workflow on fork PRs

[kuramaSeige-OFC]

Scenario & Narration

Our Auto Format workflow (auto-format.yml) runs on the pull_request_target trigger so it has the write access required to push formatting fixes back to fork branches.

However, recent runs on fork PRs are failing at the Checkout PR branch step with this error:

Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. ... Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities.

Here is why this occurs:

1. In pull_request_target, the workflow has access to write permissions and secrets (like FORMAT_BOT_PAT).
2. Newer versions of actions/checkout (v4/v6) block checking out code from a fork branch by default in privileged environments to protect the repository owner.
3. This blocks our format bot from ever running formatting on PRs from contributors.

Safety Analysis

Checking out a fork under pull_request_target is safe in our specific workflow because:

• We do not run npm install or execute any scripts from the fork branch.
• We overwrite the prettier config and .prettierignore with the trusted versions from master before executing Prettier.
• We invoke Prettier solely via npx.

Remediation Plan

We need to explicitly opt-in to checking out the fork code by adding allow-unsafe-pr-checkout: true to the checkout action block:

      - name: Checkout PR branch
        uses: actions/checkout@v6
        with:
          token: ${{ secrets.FORMAT_BOT_PAT }}
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          allow-unsafe-pr-checkout: true