Run safe checks on community PRs without waiting for maintainer approval

CI on fork PRs only starts after a maintainer approves the run (repo policy: all_external_contributors). Contributors wait hours or days to learn they're missing a changelog entry or have a PHPCS error.

The approval setting is repo-wide, so we can't trust single jobs in ci.yml. Proposal: add a small pull_request_target workflow (these run without approval) that never executes PR code. It uses trunk's checkout, tools, and configs, reads the PR's files as data only, and has a read-only token and no secrets.

• Fits: changelog entry, markdown lint, syncpack, PHPCS on changed files.
• Stays behind approval: PHPStan (loads code from the analysed tree), all tests, anything that runs pnpm install from the PR.

Trade-offs: some check logic is duplicated from ci.yml. Results can differ when a PR edits a lint config. The workflow needs a security review.

Related: the PR-readiness bot (https://github.com/woocommerce/woocommerce/pull/67081) would post its first comment from this workflow.