fix(ci): allow fork checkout in company validation workflow (#2239)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: dougaitken

.github/workflows/validate-companies.yml

@@ -33,6 +33,10 @@ jobs:
           sparse-checkout: |
             src/companies
             company-profiles
+          # Safe here: sparse-checkout limits this to data files (company
+          # profiles) only, never .github/ workflows or scripts, and nothing
+          # from the fork is executed. See https://gh.io/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
 
       - name: Get changed files
         id: changed