pull_request_target label-gated secret exposure lab

This repository mirrors a vulnerable GitHub Actions pattern for controlled security testing.