ci: fix pr-tarball for fork PRs using pull_request_target

[Hweinstock]

Description

The pr-tarball job fails on fork PRs because github.token from a fork has read-only access to the upstream repo — it cannot create releases or write PR comments.

This extracts pr-tarball into its own workflow using pull_request_target (which runs with upstream repo permissions) and gates it on author_association being OWNER, MEMBER, or COLLABORATOR. This ensures fork PRs from org members get tarballs while untrusted external PRs are skipped.

Related Issue

N/A — CI fix

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

• Validated YAML formatting via pre-commit (prettier + secretlint passed).
• The collaborator check uses github.event.pull_request.author_association which GitHub populates automatically — MEMBER covers all aws org members, COLLABORATOR covers explicitly added external users.

Checklist

• I have read the CONTRIBUTING document
• My changes generate no new warnings