Switch `lat check` to `pull_request_target` so fork PRs run without maintainer approval.

Summary

Run the lat check CI workflow automatically on fork PRs. No maintainer approval required.

Why

Fork PRs fire pull_request, which parks the run behind the GitHub's "Approve and run" gate. Contributors cannot see in the CI whether lat check passes or not.

Changed

• Switch the trigger from pull_request to pull_request_target. It isn't subject to the fork-PR approval gate, so the workflow now starts on its own.
• Check out the PR's head SHA explicitly, since pull_request_target defaults to the base branch.
• Keep previous permissions: contents: read. No PR code is executed. Skipping the gate for the lars20070/lat-check-action@v1 action is safe. Feel free to move to 1st1/lat-check-action@v1.
• All instances of .DS_Store are ignored.