Re-enable safe checkout action

[jmitrevs]

Description

Checkout v7 made the default behavior safer for pull_request_target events in the CI. We verified that the action is safe, so we are re-enabling the behavior. Please check our assessment.

Type of change

• Other (Specify) - CI

Tests

The CI should work after merging.

Checklist

• I have read the guidelines for contributing.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.
• I have installed and run pre-commit on the files I edited or added.
• I have added tests that prove my fix is effective or that my feature works.

[jmitrevs]

The KerasV3 pytest failure seems unrelated to this PR, so rerunning the test. Please look at my change to see if it seems the right way to do it, and I would suggest we try to merge today since this is holding up testing other PRs.

[Copilot]

Pull request overview

This PR updates the fork-PR “update branch” workflow to explicitly re-enable actions/checkout@v7’s ability to check out a fork PR’s head SHA in a pull_request_target-triggered workflow, gated by a maintainer-applied label.

Changes:

• Re-enables unsafe PR head checkout in pull_request_target context by setting allow-unsafe-pr-checkout: true.
• Keeps the existing label + fork-only guard and continues pushing the PR head SHA to an internal pr/<number> branch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[calad0i]

The qkeras pytest failure on accessing nonexistent envvar do seem to be irrelevant, but somehow not failing on the master. Test env regression outside repo?

[jmitrevs]

The qkeras pytest error is due to the qkeras3 not fixed versionwise. A new version caused the error. The issue is fixed in #1499 and unrelated to this PR, so I would recommend merging this.

[calad0i]

test failure is upstream, unrelated.