fix(ci): label fork PRs and skip empty Details Check matrix (#4971)

- pr-labeler ran on pull_request, which gets a read-only token for PRs
  from forks, so it failed on every contributor PR ("Could not add
  label(s)"). Run it on pull_request_target with job-scoped write
  permissions; no job checks out or runs PR code on that event.
- details-check failed the whole run when create-matrix produced an
  empty matrix (PR touches no server configs). Skip the job instead.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/action-details-check.yml

@@ -85,7 +85,8 @@ jobs:
           fi
 
   details-check:
-    if: github.repository_owner == 'GameServerManagers'
+    # Skip (rather than fail the run) when create-matrix found nothing to check.
+    if: github.repository_owner == 'GameServerManagers' && needs.create-matrix.outputs.matrix != '{"include":[]}'
     needs: create-matrix
     continue-on-error: true
     runs-on: ${{ matrix.runner }}

.github/workflows/action-issue-triage-automation.yml

@@ -43,7 +43,9 @@ on:
       - created
       - edited
       - deleted
-  pull_request:
+  # pull_request_target so pr-labeler can label PRs from forks (pull_request gets a read-only token for forks).
+  # Safe here: no job checks out or runs PR code on this event.
+  pull_request_target:
     types:
       - opened
       - edited
@@ -2267,8 +2269,12 @@ jobs:
             }
 
   pr-labeler:
-    if: github.repository_owner == 'GameServerManagers' && github.event_name == 'pull_request'
+    if: github.repository_owner == 'GameServerManagers' && github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     steps:
       - name: PR Labeler
         uses: github/issue-labeler@v3.4