fix(ci): opt showtime checkout into fork-PR code fetch under checkout v7

actions/checkout v7.0.0 (#41358) refuses to check out fork PR code from a
pull_request_target workflow unless the step sets
allow-unsafe-pr-checkout: true, which broke every showtime launch on fork
PRs. The checkout is already gated behind the maintainer-authorization
step (write/admin actors only) and uses persist-credentials: false, so
opt in explicitly and fix the stale zizmor comment that claimed the
workflow never checks out PR code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sadpandajoe

.github/workflows/showtime-trigger.yml

@@ -2,7 +2,8 @@ name: 🎪 Superset Showtime
 
 # Ultra-simple: just sync on any PR state change
 on:
-  # zizmor: ignore[dangerous-triggers] - required to react to PR label changes; this workflow does not check out or execute PR-provided code
+  # zizmor: ignore[dangerous-triggers] - required to react to PR label changes; PR code is
+  # only checked out and built after the maintainer-authorization gate (write/admin actors)
   pull_request_target:
     types: [labeled, unlabeled, synchronize, closed]
 
@@ -156,6 +157,10 @@ jobs:
         with:
           ref: ${{ steps.check.outputs.target_sha }}
           persist-credentials: false
+          # Building fork PR code is Showtime's purpose: deploys are gated on the
+          # maintainer-authorization step above (write/admin actors only), so this
+          # checkout is an explicit, authorized opt-in rather than an automatic one.
+          allow-unsafe-pr-checkout: true
 
       - name: Setup Docker Environment (only if build needed)
         if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'