fix(argus): support fork PR reviews safely

[bokelley]

Summary

• run Argus on pull_request_target so fork PRs can access the review App token and Anthropic secret
• keep checkout pinned to the trusted base SHA and inspect PR changes through GitHub APIs
• avoid local prior-SHA diffs in the skip check, falling back to full review when compare data is unavailable
• read the review prompt from the trusted base SHA with a randomized heredoc sentinel

Validation

• git diff --check