fix(automation): robust label enforcement with permission checks

[bdmorgan]

Summary

Fixes the label-enforcer workflow to properly handle maintainer permissions and avoid bot loops, while adding protection for the 🔒 maintainer only label.

Details

1. Permission Check Fix: Switches from checking team membership to checking repository permission levels directly (admin or write). This is more robust as it doesn't require the GitHub App to have Organization-level read permissions and correctly handles anyone with write access to the repository.
2. Bot Loop Prevention: Broadens the bot check to ignore all users ending in [bot]. This prevents the workflow from entering an infinite loop when interacting with other automated tools (like gemini-cli[bot]), which was causing hundreds of redundant comments.
3. Label Protection: Adds 🔒 maintainer only to the list of protected labels.

Related Issues

Fixes #16205
Fixes #14139
Fixes #16741

How to Validate

1. Permissions: Verify that a user with 'Write' access (like @bdmorgan) can modify protected labels without the workflow reverting them.
2. Bot Loop: Verify that actions by gemini-cli[bot] or other bots are ignored.
3. Label Enforcement: Verify that a non-maintainer cannot remove 🔒 maintainer only.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
  • Windows
  • Linux

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[github-actions]

Size Change: -2 B (0%)

Total Size: 23.1 MB

ℹ️ View Unchanged

Filename	Size	Change
./bundle/gemini.js	23 MB	-2 B (0%)
./bundle/sandbox-macos-permissive-closed.sb	1.03 kB	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-closed.sb	3.29 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B

_{compressed-size-action}