fix: allow claude code review workflow to run on PRs from forks

Switch from pull_request to pull_request_target event to enable
OIDC token access for external contributor PRs. This allows the
Claude Code action to authenticate properly when reviewing PRs
from forks.

Also added explicit PR head SHA ref to checkout to ensure we
review the correct code.

Fixes workflow failure: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL

.github/workflows/claude-code-review.yml

@@ -1,7 +1,7 @@
 name: Claude Code Review
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, ready_for_review, reopened]
     # Optional: Only run on specific file changes
     # paths:
@@ -29,6 +29,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
 
       - name: Run Claude Code Review