fix(ci): prevent duplicate label events on Dependabot PRs

Dependabot's built-in label config fires duplicate API calls due to a
race condition, emitting two "labeled" webhook events. Move labeling to
a GitHub Action that checks existing labels before adding, ensuring a
single clean event.

Author: rax-it

.github/dependabot.yml

@@ -9,8 +9,6 @@ updates:
       directory: '/' # Location of package manifests
       schedule:
           interval: 'weekly'
-      labels:
-          - 'USER STORY'
       ignore:
           # As a library, we intentionally avoid updating TypeScript and @types/node so that we
           # don't accidentally use features from a version newer than our downstream users have installed

.github/workflows/dependabot-label.yml

@@ -0,0 +1,31 @@
+name: Label Dependabot PRs
+
+on:
+    pull_request:
+        types: [opened]
+
+jobs:
+    label:
+        if: github.actor == 'dependabot[bot]'
+        runs-on: ubuntu-latest
+        permissions:
+            pull-requests: write
+        steps:
+            - name: Add label if missing
+              uses: actions/github-script@v7
+              with:
+                  script: |
+                      const label = 'USER STORY';
+                      const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: context.issue.number,
+                      });
+                      if (!labels.some(l => l.name === label)) {
+                        await github.rest.issues.addLabels({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          labels: [label],
+                        });
+                      }