Summary

• Remove pull_request_target from pr_follow_up_checks.yml; queue follow-up checks from Validation's requested and in_progress events, and mark queued checks skipped when Validation fails or is cancelled.
• Check out the trusted workflow SHA without persisting credentials in the queue and primer-comment workflows.
• Verify the source primer run, successful Validation, and complete artifact inventory using the existing loadSource validation. Resolve the target PR from trusted Validation metadata instead of artifact-provided pr_number.txt, and recheck the PR head immediately before commenting.
• Read only the eight expected, bounded diff entries from ZIP archives without extracting archive paths. Add focused regression coverage and document the trust boundaries.

Behavior change

Follow-up checks now appear when Validation is requested or starts, rather than immediately when a PR opens or updates. Existing check reporting, fork PR resolution, and stale-head rejection are preserved. Generated advisory-analysis workflows are unchanged.

Verification

• Five focused Python unittest cases pass, including executable YAML-reading guards for queue/report behavior, validated PR resolution, read-only candidate execution, primer provenance, artifact inventory rejection, stale PRs, and bounded archive contents.
• ESLint passes for the changed JavaScript helper.
• Prettier passes for the changed workflows, JavaScript helper, and documentation; git diff --check passes.

Live GitHub Actions execution has not been verified locally; the Validation-driven triggers require the updated workflow on the default branch.