Add label-triggered PerfStar evaluation workflow

[baronfel]

Summary

• trigger PerfStar evaluation when PerfStar: Evaluate is added to a pull request
• refresh the short-lived perf/pr-<number> branch whenever a tracked pull request is updated
• remove generated branches when tracking ends or the pull request closes
• avoid checking out or executing pull request code while retaining fork pull request support

Security

The workflow uses pull_request_target only for base-repository API access. It does not check out or execute pull request code, pins actions/github-script by SHA, and grants contents: write only to the jobs that update refs.

Zizmor 1.25.2 reports no findings (one documented dangerous-triggers exception).

Since only repo maintainers, triagers, and admins can modify labels, this makes it an explicit decision to run perf analysis on explicitly trusted PRs.

Deployment note

The PerfStar: Evaluate repository label must exist before this workflow can be used.