Problem:
We have 5 "labeler" jobs, this is kind of nuts, it bloats the CI report,
and also introduces race conditions...
Solution:
Merge 3 jobs into 1 `label` job with multiple sequential steps.
- Eliminates the `needs` chain
- Drops unused `contents:write` permission.
- GITHUB_TOKEN is scoped to the single `gh` step.
- Note: is the automatic job token (`contents:read` + `pull-requests:write`,
not a PAT), so worst case is PR/label mischief.
The `ai-assisted` and `request-reviewer` jobs stay separate, bc they are
triggered on different events (not only "opened").
The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions
Splitting it on word boundaries rather than only spaces allows for better
detection. The issue labeler previously didn't catch titles such as
`treesitter: noisy "Invalid node type" error`.
Co-authored-by: casswedson <casswedson@users.noreply.github.com>
