FormatCheck fails for fork PRs: pull_request_target can no longer check out fork code

[lkdvos]

Problem

The reusable FormatCheck.yml workflow in QuantumKitHubActions is called from consumers via a pull_request_target trigger and checks out the PR head from the contributor's fork:

- uses: actions/checkout@v5
  with:
    ref: ${{ github.event.pull_request.head.ref }}
    repository: ${{ github.event.pull_request.head.repo.full_name }}

GitHub has hardened actions/checkout to refuse checking out fork PR code from a pull_request_target workflow (the classic "pwn request" vulnerability, since pull_request_target runs with the base repo's write-scoped token and secrets). The checkout step now fails for any PR from a fork:

Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access.

Example failure: https://github.com/QuantumKitHub/MPSKit.jl/actions/runs/30046660422/job/89339282218?pr=460

As a result, formatting checks are broken for all external contributors (non-members opening PRs from forks). It still passes for maintainers pushing branches within the repo, because then the head repo is the base repo and nothing untrusted is checked out.

Fix

Switch the whole flow to a plain pull_request trigger, which runs with a read-only token and no secrets — so it is safe to check out and inspect fork code, and GitHub allows it.

In QuantumKitHubActions, rework the reusable FormatCheck.yml:

• Reduce permissions to contents: read.
• Drop the PR-comment steps (they would 403 under a fork's read-only token).
• Report the required formatting diff + git runic instructions in the job summary, and fail the job so it surfaces as a red check.

In each consumer repo, change the workflow trigger from pull_request_target to pull_request and drop the actions: write / pull-requests: write permissions.

Affected consumer repos

• BlockTensorKit.jl
• CategoryData.jl
• MatrixAlgebraKit.jl
• MPSKit.jl
• MPSKitModels.jl
• PEPSKit.jl
• QWignerSymbols.jl
• SparseArrayKit.jl
• Strided.jl
• StridedViews.jl
• SUNRepresentations.jl
• TensorKit.jl
• TensorKitManifolds.jl
• TensorKitSectors.jl
• TensorKitTensors.jl
• TensorOperations.jl
• TNRKit.jl
• VectorInterface.jl

Merge ordering

The reusable-workflow change in QuantumKitHubActions should land on main before (or together with) the consumer PRs, since consumers reference FormatCheck.yml@main.