ci: harden trusted workflow checkout and secrets handling

[tim48-robot]

fixes:

[github-actions]

⚠️ PR Description Issues Detected

• Missing issue reference (e.g., 'Fixes Graphics #123')

Please update the PR description to address these issues.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR addresses critical security vulnerabilities in GitHub Actions workflows by removing an insecure trusted workflow and hardening the PR checks workflow to follow security best practices.

Key Changes:

• Removed the trusted-playwright.yml workflow that had a severe security vulnerability exposing production secrets to untrusted PR code
• Changed pr-checks.yml from pull_request_target to pull_request trigger to prevent secret exposure
• Added explicit least-privilege permissions (contents: read) and fallback logic for both PR and push event handling

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/trusted-playwright.yml	Deleted entire workflow that was checking out untrusted PR code while having access to production secrets (Firebase credentials) - this was a critical security vulnerability
.github/workflows/pr-checks.yml	Changed from pull_request_target to pull_request trigger, added explicit contents: read permission, and added fallback logic for ref/repository to safely handle both PR and push events

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.