The Pwn Request Reckoning: What Still Works Against GitHub Actions

GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.