Run format check on pull_request instead of pull_request_target

[leburgel]

The shared format check in QuantumKitHub/QuantumKitHubActions is now meant to be called from pull_request (QuantumKitHub/QuantumKitHubActions@e3f4c85). Called from pull_request_target, as here, actions/checkout refuses to check out the fork's code, so the check fails on every PR from a fork before Runic runs, e.g. #170:

Refusing to check out fork pull request code from a 'pull_request_target' workflow.

This switches the trigger to pull_request and drops the write permissions, matching TensorKit.jl and MPSKit.jl.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.65%. Comparing base (4808454) to head (cb70e2a).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #171      +/-   ##
==========================================
- Coverage   88.47%   86.65%   -1.83%     
==========================================
  Files          36       36              
  Lines        3965     3918      -47     
==========================================
- Hits         3508     3395     -113     
- Misses        457      523      +66     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.