ci(deps): label Lemonade bump PRs and request maintainer reviews

[kovtcharov-amd]

The Lemonade auto-bump workflow (#1552) opened its first real PR (#1571, v10.2.0 → v10.7.0) tagged only dependencies and with no reviewers, so bump PRs don't surface to the platform owners and miss the team's Lemonade triage label. This adds the lemonade 🍋 label and requests both kovtcharov-amd and itomek-amd on every bump PR the workflow opens.

Verified end-to-end: applied the same label + reviewers to the live test PR #1571 via gh pr edit (the bot author can request both — confirms the runtime gh pr create --reviewer path works), and both are repo collaborators.

Test plan

• lemonade 🍋 is the exact label name (space + emoji) — gh label list
• kovtcharov-amd and itomek-amd are collaborators (review requests won't fail)
• YAML parses
• Next scheduled/forced run opens a bump PR carrying both labels + both reviewers

[github-actions]

Review: ci(deps): label Lemonade bump PRs and request maintainer reviews

Approve. Clean, well-scoped CI fix that makes auto-generated Lemonade bump PRs discoverable to the platform owners. The change adds --label "lemonade 🍋" and --reviewer kovtcharov-amd,itomek-amd to the gh pr create invocation inside the bump workflow's agent prompt, plus two lines of guidance so the agent preserves the emoji-and-space label verbatim.

Summary

The only changed file is .github/workflows/lemonade-version-bump.yml (+5/−1), all inside the heredoc prompt the workflow hands to the bump agent. I independently verified the three runtime preconditions that would otherwise fail the gh pr create call:

• ✅ The label lemonade 🍋 exists exactly (space + emoji), color #fbca04 — gh label list.
• ✅ Both kovtcharov-amd and itomek-amd are repo collaborators — gh api .../collaborators/<user> returns 204, so the review requests won't be rejected.
• ✅ The workflow YAML still parses (yaml.safe_load).

No security surface, no breaking changes, no docs/tests implicated (CI-prompt-only change). No prompt-injection concerns in the diff — it's legitimate workflow config.

Issues Found

None blocking.

🟢 Reviewer-request failure is loud, which is the right behavior — just flagging the edge (lemonade-version-bump.yml:210). gh pr create --reviewer creates the PR and then requests reviews; if a request ever fails (e.g. a collaborator is later removed), the step exits non-zero after the PR already exists, so a re-run could try to recreate it. Not worth changing now — collaborator status is verified and the fail-loud exit is correct per the repo's no-silent-fallbacks rule. Noting only so it's on record if the bump workflow ever starts double-opening PRs.

Strengths

• The two-line guidance ("keep it quoted exactly", "both reviewers required") is exactly the kind of hint an LLM agent needs to not silently drop the emoji label — pairs the mechanical change with the intent.
• Verification was real, not assumed: the description shows the label + reviewers were applied to the live test PR chore(deps): bump Lemonade Server to v10.7.0 #1571 first, confirming the bot-author --reviewer path works (a bot author requesting human reviewers, not requesting itself, so the "can't review your own PR" gh error doesn't apply).
• Tight, scope-clean diff — one file, one logical change, conventional-commits title.

Verdict

Approve — ready to merge. The remaining checkbox in the test plan (next scheduled run carrying both labels + reviewers) can only be confirmed post-merge by observation, which is expected for a workflow-prompt change.