fix(round): labeler.yml header tells the truth; labels-scope maps to scope:labels

The mapping header still described actions/labeler@v5 + sync-labels —
the exact mechanism this PR removed; it now describes labels-scope's
base-ref read and additive POST, keeping the #128 incident. The
scope:labels row gains actions/labels-scope/** and its test, and two
fixtures derive against the real mapping so the coverage is tested, not
just present. The reconcile job comment names labels-scope instead of
labeler (grok nit 3).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/labeler.yml

@@ -1,9 +1,11 @@
 # Path → scope:* mapping for the labels workflow's scope job
-# (actions/labeler@v5; additive only — the reusable workflow keeps
-# sync-labels off, so a hand-applied scope survives the machine). The scope
+# (actions/labels-scope since #130: it reads this mapping at the BASE ref
+# and its only write is an additive POST, so a label applied while the job
+# runs survives the machine — its predecessor, actions/labeler@v5, PUT the
+# whole set and clobbered ceremony#128's `release` mid-job). The scope
 # taxonomy itself lives in .github/labels.conf; LABELS.md carries the table
 # these globs implement. Scopes locate, they do not alert — a path that maps
-# to nothing is fine (labeler is advisory), so these rows chase the big
+# to nothing is fine (the mapping is advisory), so these rows chase the big
 # surfaces, not every file.
 scope:release-flow:
   - changed-files:
@@ -41,9 +43,11 @@ scope:labels:
           - .github/labeler.yml
           - .github/labels.conf
           - actions/labels-reconcile/**
+          - actions/labels-scope/**
           - LABELS.md
           - test/labels.test.sh
           - test/labels-reconcile.test.sh
+          - test/labels-scope.test.sh
 scope:docs:
   - changed-files:
       - any-glob-to-any-file:

.github/workflows/labels.yml

@@ -86,9 +86,9 @@ jobs:
       cancel-in-progress: false
     steps:
       # pull_request_target is required for fork PR write permission. It is
-      # safe here because no PR code is ever checked out or executed: labeler
-      # reads paths via the API, and reconcile checks out the BASE branch only.
-      # Keep it that way.
+      # safe here because no PR code is ever checked out or executed:
+      # labels-scope reads the mapping and changed paths via the API, and
+      # reconcile checks out the BASE branch only. Keep it that way.
       - uses: actions/checkout@v4
         with:
           repository: ${{ github.repository }}

test/labels-scope.test.sh

@@ -98,6 +98,15 @@ EOF
   check "parse: ceremony's own labeler.yml" 0 \
     "scope:labels${TAB}.github/labeler.yml" parses "$ROOT/.github/labeler.yml"
 
+  # the real mapping covers this implementation's own surface (#133 round):
+  # a PR touching only labels-scope must still derive scope:labels, like
+  # the neighboring labels-reconcile rows already did
+  real_rows="$(parses "$ROOT/.github/labeler.yml")"
+  check "derive: the real mapping labels a labels-scope-only change" 0 \
+    "scope:labels" derive_labels "$real_rows" 'actions/labels-scope/labels-scope.sh'
+  check "derive: the real mapping labels this test file" 0 \
+    "scope:labels" derive_labels "$real_rows" 'test/labels-scope.test.sh'
+
   # refusals: unsupported shapes fail loudly, naming the label
   cat >"$TMP/allglobs.yml" <<'EOF'
 scope:x: