fix: run version-suggestion as pull_request_target so fork PRs get a writable token

[aesslinger]

Summary

• Splits the version-suggestion job out of ci.yml into its own workflow, .github/workflows/version-suggestion.yml, triggered on pull_request_target instead of pull_request.
• pull_request_target runs with the base repo's token permissions even for fork-originated PRs, fixing the 403 when posting the version-suggestion comment.
• The job never checks out or executes PR content — it only reads github.event.pull_request.title/body/labels from the event payload — so this is safe, per option 1 in the issue.
• Removed labeled/unlabeled from ci.yml's pull_request trigger types since those were only needed for this job, which now has its own trigger types in the new file. Avoids redundant reruns of unrelated CI jobs (test, clippy, markdownlint, etc.) on label changes.

Fixes #115.

Test plan

• actionlint passes on both ci.yml and version-suggestion.yml (pre-existing shellcheck style warnings in the copied script body confirmed present on main before this change too)
• markdownlint clean (no .md changes)
• Confirm on a real fork PR that Version suggestion now posts/updates a comment instead of 403ing