Dependabot PRs don't receive repo secrets under pull_request events, causing DEPLOY_PAT to be empty. Switch to pull_request_target which runs in the base branch context with full secret access. Safe because the workflow only runs for dependabot[bot] and only executes pnpm install -- no PR-supplied code is run.