fix(ci): review pull_request_target events

[bokelley]

Summary

• recognize pull_request_target as a pull-request event in AAO-SECRETARIAT setup
• preserve support for direct pull_request events and reject unrelated events
• rebuild the committed setup action bundle

Root cause

The repository invokes AAO-SECRETARIAT from a pull_request_target workflow, but setup only accepted an exact pull_request event name. Every review therefore exited successfully with skip-reason=not-a-pull-request before the reviewer or arbiter ran.

Security posture

The workflow continues to check out only the trusted base SHA. The PR head remains API-read data and is never fetched or executed.

Validation

• setup action Vitest: 8 files, 68 tests passed
• setup action typecheck passed in isolated expert validation
• setup action production bundle rebuilt
• local security reviewer: no findings
• local code reviewer: no findings

This PR modifies the reviewer itself, so the repository intentionally requires human/local review and will not self-review it.