fix: align publication restore with pull_request_target

actions/publication/action.yml

@@ -19,7 +19,7 @@ inputs:
   post-merge-event:
     description: Workflow event that produced the finalized release-state artifact.
     required: false
-    default: pull_request
+    default: pull_request_target
   attempts:
     description: Maximum PublicationVerification attempts while publisher and App Store state converge.
     required: false

tests/Acceptance/ReleaseActionsTest.php

@@ -110,6 +110,17 @@ public function testReleaseIdentityDelegatesValidationToPhp(): void
         self::assertStringNotContainsString('git ls-remote', $content);
     }
 
+    public function testPublicationDefaultsToPullRequestTargetPostMergeEvent(): void
+    {
+        $action = Yaml::parseFile($this->root() . '/actions/publication/action.yml');
+        self::assertIsArray($action);
+
+        self::assertSame(
+            'pull_request_target',
+            $action['inputs']['post-merge-event']['default'] ?? null,
+        );
+    }
+
     public function testPublicationDelegatesRestoreAndVerificationToPhp(): void
     {
         $content = $this->action('publication');