ci: gate setup-universe behind run:health-check, unify label reusable

[xmfcx]

• Parent Issue: Simplify the docker images and workflows #6852
• Gate setup-universe behind the run:health-check label: add a require-label job plus needs: / if: on the existing setup-universe job, and add pull_request.types (opened, synchronize, reopened, labeled) so the workflow re-triggers when the label is added mid-review.
• Switch health-check.yaml from make-sure-label-is-present.yaml@v1 to require-label.yaml@v1 (job renamed label-check → require-label).

Why

setup-universe runs setup-dev-env.sh on a self-hosted runner and consumes meaningful time on every PR. It only needs to run for infrastructure-touching PRs — the same gate health-check already uses. A single run:health-check label now toggles both heavyweight pre-merge checks. Switching both callers to require-label.yaml@v1 aligns with the sub-repo build-and-test workflows and surfaces missing labels as red status rather than silent skips.

---

• 2 of 6 PRs splitting ci(docker-new): split base-cuda layer and restructure CI pipelines #7025. Builds on ci(apt): harden apt with retries + Azure mirror + archive fallback #7028 (merged).

Test plan

• Open a PR touching .github/workflows/setup-universe.yaml without the run:health-check label. Expect the require-label job red and setup-universe skipped.
• Add the run:health-check label to that PR. Expect require-label green and setup-universe to proceed through to Run setup script.
• Trigger health-check via schedule or workflow_dispatch with no label. Expect require-label skipped but docker-build still running because the if: admits schedule/workflow_dispatch.

[github-actions]

Thank you for contributing to the Autoware project!

🚧 If your pull request is in progress, switch it to draft mode.

Please ensure:

• You've checked our contribution guidelines.
• Your PR follows our pull request guidelines.
• All required CI checks pass before marking the PR ready for review.

[mitsudome-r]

LGTM!