pr-risk apply-label fork 403

Trap: apply-label: "true" looks valid because pr-risk.yml grants issues: write, but fork pull_request tokens remain read-only and label PATCHes fail with GitHub 403 after scoring succeeds. Fix: set apply-label to ${{ github.event.pull_request.head.repo.full_name == github.repository }} so forks still produce scores/artifacts while same-repository PRs retain labels. Reject privileged execution of fork code because it exposes write credentials to untrusted changes.