permission_check fails on fork PRs before it checks anything (checkout v7 refuses the head ref)

先阅读 init-svc-executable-permissions.yml，然后比较 docker-mod-builder.yml 中的 checkout 步骤。跟踪 issue 中描述的权限检查和 git trees API 方法；完成的标准是 fork-head 权限检查能够正常工作，同时不使用不安全的 checkout，也不改变 pull_request_target 的安全性，包括文档中记录的 fork 和内部情况。

init-svc-executable-permissions.yml fails on a fork pull request that touches run, finish, check or root/migrations/*. The job stops before any file is read, because actions/checkout@v7.0.1 refuses pull_request.head.sha in a pull_request_target workflow.

PR #190 shows it: https://github.com/linuxserver/docker-baseimage-selkies/actions/runs/33459741080/job/99707212121
The checkout step ends with:

##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

"Check Permissions" is then skipped and the job fails. On that head SHA (a5272e08) all 13 run/finish files are 100755, so the check would have passed.

The switch to checkout 7 reached v1 with 6c9815b8 on 2026-07-03; the first fork run after that is from 2026-07-06. Since then 45 fork-head runs across linuxserver have failed and 7 internal-head runs have passed. After the switch and before that first fork run, docker-sabnzbd run 28709064096 (2026-07-04) passed: **** All perms look good ****. Twelve open fork pull requests carry a red permission_check; three more are green from before the switch.

f3577570 pinned the step to the head SHA because the check needs the PR's own files. The file modes can be read without a checkout: the git trees API on the base repository reaches the fork head through refs/pull/N/head, so the job can flag any matching blob that is not 100755 without fetching fork code. At a5272e08 it returns truncated: false, 151 entries, 13 of them run/finish blobs, all 100755. That leaves pull_request_target and the pinned ref untouched, with no allow-unsafe-pr-checkout. The same checkout step sits in docker-mod-builder.yml, which handles CR_PAT and DOCKERPASS.