ci: run tests on dev PRs and stop the quality gate crashing on forks

[prakashUXtech]

What

Two fixes to the GitHub Actions setup, both surfaced while reviewing the open community PRs (#268, #274, #276).

1. Run CI on PRs targeting dev. ci.yml only triggered on pushes and PRs to main, but dev is the working branch. Every dev-targeted PR was merging without ruff or the 3.11/3.12/3.13 pytest matrix ever running, so a green tick on those PRs proved nothing. This adds dev to both the push and pull_request triggers.

2. Stop the quality gate crashing on fork PRs. PRs from forks run with a read-only GITHUB_TOKEN regardless of the workflow's permissions: block, so issues.addLabels returned 403 and the whole check-quality step failed for the wrong reason (it read as a real quality failure). The label and comment writes are now wrapped so a read-only token is handled gracefully: the gate still reports its verdict through the run summary and an annotation, and same-repo PR behavior is unchanged.

Why now

Three fork PRs are open right now (Siddhant's #268/#274/#276). On each, the only checks that ran were this gate (which crashed) and the security scan. Lint and tests never ran at all. That is a blind spot at exactly the moment we're merging outside contributions.

Testing

• YAML parses for both workflows.
• The embedded github-script JS passes node --check.
• The behavior change is scoped to trigger config and to try/catch around API writes; no job logic was altered.

CI on this PR is itself the live proof of fix 1: with dev added to the trigger, the lint and test matrix should now run on this dev-targeted PR (it would not have before).

Not touched

The gate stays non-blocking (it comments and warns; it does not fail the check on hygiene issues). Whether it should hard-fail is a separate policy call, left out of this PR.

Follow-on: pre-existing lint debt

Turning the gate on immediately surfaced ruff debt that had never been checked on dev (which is the whole point). A second commit clears it so the gate actually passes:

• F811: the note command's function was named observe_cmd, colliding with the observe command's function of the same name. Both commands register correctly (Click keys on the decorator, not the Python name), so this is a rename to note_cmd with no behavior change.
• ruff format / I001: import ordering and formatting on six test files.

No logic changes in that commit. Verified locally: ruff check . and ruff format --check . both clean, and the 3.11/3.12/3.13 test matrix passes.

[github-actions]

Issues (must fix)

• No evidence of local testing found. Please include terminal output or screenshots.

Heads up

• This PR touches sensitive files (CI/CD workflows). These paths require maintainer review via CODEOWNERS.

Please update your PR to address these points.