fix(ci): handle fork-PR triage commands via workflow_run handoff

[hubcio]

issue_comment and pull_request_review get a read-only
GITHUB_TOKEN on cross-fork PRs regardless of the workflow's
permissions: block, so /ready, /author and /request-review
silently no-op'd on contributor PRs (#3235).

Split into pr-triage-collect.yml (read-only collector,
uploads event payload as artifact) and pr-triage-apply.yml
(workflow_run on base ref, write token, applies labels).
pull_request_target lifecycle stays in apply.yml directly.

Body crosses the boundary via payload/body.txt, not
GITHUB_ENV - a forged heredoc terminator can no longer
inject NODE_OPTIONS into the github-script step. setLabels
is atomic replace-all (list, drop sibling, single
setLabels), removing the both-labels terminal state on any
interleaving (workflow_run concurrency cannot re-key on PR#
before parse).

Also: PR_NUMBER validation, draft re-check after pulls.get,
latency + Actions-tab note in welcome and CONTRIBUTING.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.82%. Comparing base (fd4dbf6) to head (eea813e).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3268      +/-   ##
============================================
- Coverage     73.87%   73.82%   -0.06%     
  Complexity      943      943              
============================================
  Files          1193     1193              
  Lines        108970   108970              
  Branches      85988    86005      +17     
============================================
- Hits          80505    80448      -57     
- Misses        25733    25760      +27     
- Partials       2732     2762      +30     

Components	Coverage Δ
Rust Core	74.89% <ø> (-0.05%)	⬇️
Java SDK	60.14% <ø> (ø)
C# SDK	69.15% <ø> (-0.29%)	⬇️
Python SDK	81.43% <ø> (ø)
Node SDK	91.41% <ø> (ø)
Go SDK	39.80% <ø> (ø)
see 26 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.