Fork PRs run pull_request_review workflows with a restricted GITHUB_TOKEN
that cannot write labels, so the lgtm label never lands on approval and the
labeled-trigger CI cycle does not fire for external contributors.
The original workflow now skips its inline label step on fork PRs and
uploads the review event payload as an artifact. A companion workflow
listens via workflow_run from the base repo context, downloads the
artifact, and applies the label with elevated permissions. No third party
app or PAT is required.
f3ff22baa3