ci: enable online tests for fork PRs via safe-to-test label

[flipbit03]

Problem

Fork PRs cannot access repository secrets in GitHub Actions (by design). This means the Tests (Online) job always fails for external contributions, since LINEAR_TEST_TOKEN is empty.

This blocks us from verifying that fork contributions actually work against the real Linear API before merging.

Solution

1. Skip test-online in ci.yml when no secret is available — removes the misleading red X on fork PRs
2. Add a pull_request_target workflow gated on a safe-to-test label that runs online tests with the secret
3. Maintainer reviews the fork PR code, adds the safe-to-test label, online tests run
4. If new commits are pushed, the label should be removed and re-evaluated

Security model

• pull_request_target reads the workflow YAML from main, not from the fork — the fork cannot modify the workflow to exfiltrate the secret
• The fork's code is only checked out for build/test steps
• The label gate ensures a maintainer has reviewed the code before secrets are exposed

References

• PR feat: --project filter on issues list #88 is the first fork PR hitting this: feat: --project filter on issues list #88