ci: run sync-pr-labels on pull_request_target only

Fork PRs receive a read-only GITHUB_TOKEN on pull_request, so
issues.addLabels fails with 403. This workflow only uses the API
(no PR checkout), so pull_request_target is the correct trigger.

Made-with: Cursor

Author: shubham5080

.github/workflows/sync-pr-labels.yml

@@ -1,8 +1,9 @@
 name: Sync PR Labels
 
+# Use pull_request_target only: fork PRs get a read-only GITHUB_TOKEN on
+# pull_request, so issues.addLabels returns 403. This job only calls the API
+# (no checkout of PR code), which is the safe pattern for pull_request_target.
 on:
-  pull_request:
-    types: [opened, reopened, synchronize, edited]
   pull_request_target:
     types: [opened, reopened, synchronize, edited]