pull_request_target runs in the base-repo context with secrets and a write token, unlike pull_request (fork context, no secrets). It does not run after merge (that is push), does not use the head branch workflow (it uses base), and is not about environments.
Official docs