Generate conventional-commits PR titles + repo-existing labels

Surfaced during the fix-mode PoC against master/v1.6/v1.7. The agent
opened three valid fix PRs (#4442, #4443, #4444) but with generic
'ci-mx: PoC fix CI failures on <branch>' titles and zero labels. The
repo convention is 'ci: <description>' with optional '(release/vX.Y)'
suffix, plus flat labels like ci/cni/cns/cilium/dependencies.

Fix: in the Fix-PR creation section, generate:

- Title: ci: <description> [(release/vX.Y) | for #N [(release/vX.Y)]]
  where <description> is 're-render Dockerfiles', 'resolve govulncheck
  findings', or 're-render Dockerfiles and resolve govulncheck
  findings' depending on which playbooks committed.

- Labels: always 'ci'; add 'dependencies' when govulncheck ran; add
  area labels (cni, cns, cilium) by matching paths in the commit's
  diff against a small known-area map. Filter the final set against
  'gh label list' so labels that don't exist in the repo are skipped
  (no auto-creation).

The three existing PoC PRs were retitled and relabeled to match.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jpayne3506

.github/agents/ci-mx.md

@@ -528,11 +528,75 @@ After the playbooks have made at least one commit on `$fix_branch`:
 ```bash
 cd "$work_dir"
 git push -u origin "$fix_branch"
+```
+
+### Title generation
+
+Conventional-commits style (`ci: <description>`) to match the repo
+convention. Append `(<branch>)` suffix when `$target_branch` is a
+release branch:
 
-fix_pr_title="ci-mx: fix CI failures on $target_branch"
+```bash
+case "$RAN_GOVULNCHECK,$RAN_BASEIMAGES" in
+  true,true)  desc="re-render Dockerfiles and resolve govulncheck findings" ;;
+  true,false) desc="resolve govulncheck findings" ;;
+  false,true) desc="re-render Dockerfiles" ;;
+  *)          desc="apply ci-mx fixes" ;;
+esac
+
+case "$target_branch" in
+  release/*) fix_pr_title="ci: $desc ($target_branch)" ;;
+  *)         fix_pr_title="ci: $desc" ;;
+esac
+
+# When a source PR exists, prefix with its number so reviewers can
+# trace the chain.
 [ -n "$source_pr_number" ] && \
-  fix_pr_title="ci-mx: fix CI failures for #$source_pr_number ($target_branch)"
+  fix_pr_title="ci: $desc for #$source_pr_number${target_branch:+ ($target_branch)}"
+```
+
+### Label generation
+
+Always-on: `ci`. Govulncheck commits add `dependencies`. File-touched
+heuristic adds repo-existing area labels (`cni`, `cns`, `cilium`,
+etc.) when matching paths appear in the commit's diff. The set is
+filtered against `gh label list` to skip any label that doesn't exist
+in the repo (no auto-creation).
+
+```bash
+labels=("ci")
+[ "${RAN_GOVULNCHECK:-false}" = "true" ] && labels+=("dependencies")
+
+# Derive area labels from the commit's diff (HEAD~..HEAD covers both
+# possible playbook commits; HEAD~..HEAD covers the single-commit case
+# too if the worktree's HEAD~ is the baseline).
+touched=$(git diff --name-only "$target_head_sha"..HEAD)
+declare -A area_map=(
+  [cni]="^cni/"
+  [cns]="^cns/"
+  [cilium]="^cilium|^bpf-prog/"
+)
+for label in "${!area_map[@]}"; do
+  if echo "$touched" | grep -qE "${area_map[$label]}"; then
+    labels+=("$label")
+  fi
+done
+
+# Filter to labels that actually exist in the repo (no auto-create).
+existing=$(gh label list --repo "$GH_NAMEWITHOWNER" \
+           --limit 200 --json name --jq '.[].name')
+final_labels=()
+for l in "${labels[@]}"; do
+  echo "$existing" | grep -qx "$l" && final_labels+=("$l")
+done
 
+label_args=()
+for l in "${final_labels[@]}"; do label_args+=(--label "$l"); done
+```
+
+### Body and create
+
+```bash
 fix_pr_body=$(cat <<EOF
 Automated fix from \`ci-mx\` for CI failures on \`$target_branch\` at \`$target_head_sha\`.
 
@@ -545,15 +609,16 @@ templates, or the Go toolchain. Never auto-merged.
 EOF
 )
 
-# Fix PR targets the SOURCE branch so the diff is just the mechanical fix
+# Fix PR targets the source branch so the diff is just the mechanical fix
 # (not the full source-PR diff). Dev merges the fix PR into their source
 # branch, which adds the fix commits to the source PR. For direct
 # master/release failures, $target_branch is the trunk itself.
 fix_pr_url=$(gh pr create \
   --base "$target_branch" \
   --head "$fix_branch" \
   --title "$fix_pr_title" \
-  --body "$fix_pr_body")
+  --body "$fix_pr_body" \
+  "${label_args[@]}")
 
 if [ -n "$source_pr_number" ]; then
   gh pr comment "$source_pr_number" \