fix(ci): use pull_request_target so claude bot gets secrets on fork PRs

.github/workflows/claude-bot.yml

@@ -5,7 +5,7 @@ on:
     types: [opened]
   issue_comment:
     types: [created]
-  pull_request:
+  pull_request_target:
     types: [opened]
 
 permissions:
@@ -265,7 +265,7 @@ jobs:
               code, run builds/tests, commit, or open a PR.
 
   handle-pr:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     permissions:
       contents: read