docs: fix review findings round 2 for ADR 0043

- Rename gitlab-support.md title to "GitLab Support via Webhook Bridge"
  to differentiate from the superseded gitlab-implementation.md
- Fix determine-stage dotenv propagation: add determine-stage to
  trigger-stage needs array so $STAGE variable is available
- Fix label detection: use changes.labels.current[-1].name instead of
  .labels[-1].name to extract the just-added label from the webhook
  changes field
- Note ADR 0028 supersession in ADR 0031 cross-reference
- Note ADR 0028 supersession in agent-execution-environment.md references

Signed-off-by: Greg Allen <gallen@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ggallen

docs/ADRs/0031-reusable-workflows-for-action-installed-distribution.md

@@ -141,7 +141,7 @@ caller's perspective.
   inline, which partially mitigates this.
 - **GitHub-specific mechanism:** `workflow_call` and `secrets:` passthrough are
   GitHub Actions primitives with no direct equivalent in other CI systems.
-  Multi-forge support ([ADR 0028](0028-gitlab-support.md)) will need its own
+  Multi-forge support ([ADR 0043](0043-gitlab-support-via-webhook-bridge.md), supersedes ADR 0028) will need its own
   distribution mechanism (e.g., GitLab CI/CD Components or `include:`)
   independent of this ADR.
 - **Scaffold output changes:** `fullsend admin install` will emit thin callers

docs/plans/agent-execution-environment.md

@@ -922,7 +922,7 @@ spec:
 - [ADR-0036: Agent Execution Sandbox Architecture](../ADRs/0036-agent-execution-sandbox.md)
 - [ADR-0017: Credential Isolation for Sandboxed Agents](../ADRs/0017-credential-isolation-for-sandboxed-agents.md)
 - [ADR-0025: Provider Credential Delivery](../ADRs/0025-provider-credential-delivery-for-sandboxed-agents.md)
-- [ADR-0028: GitLab Support Architecture](../ADRs/0028-gitlab-support.md)
+- [ADR-0028: GitLab Support Architecture](../ADRs/0028-gitlab-support.md) (superseded by [ADR-0043](../ADRs/0043-gitlab-support-via-webhook-bridge.md))
 - [agent-infrastructure.md](../problems/agent-infrastructure.md): Infrastructure layer exploration
 - [OpenShell Documentation](https://docs.nvidia.com/openshell/)
 - [Sigstore Cosign](https://docs.sigstore.dev/cosign/overview/)

docs/problems/gitlab-support.md

@@ -1,4 +1,4 @@
-# GitLab Support Implementation Details
+# GitLab Support via Webhook Bridge
 
 This document contains implementation details for GitLab support in fullsend. For the architectural decision and rationale, see [ADR 0043](../ADRs/0043-gitlab-support-via-webhook-bridge.md).
 
@@ -589,7 +589,7 @@ determine-stage:
           case "$ACTION" in
             open|update) STAGE="triage" ;;
             labeled)
-              LABEL=$(echo "$PAYLOAD" | jq -r '.labels[-1].name // ""')
+              LABEL=$(echo "$PAYLOAD" | jq -r '.changes.labels.current[-1].name // ""')
               case "$LABEL" in
                 ready-to-code) STAGE="code" ;;
                 ready-for-review) STAGE="review" ;;
@@ -672,7 +672,7 @@ generate-child-config:
 
 trigger-stage:
   stage: dispatch
-  needs: [generate-child-config]
+  needs: [determine-stage, generate-child-config]
   rules:
     - if: $CI_COMMIT_REF_PROTECTED == "true" && $CI_PIPELINE_SOURCE == "trigger" && $STAGE
   trigger: