fix: keep labels caller within pinned feature set

.github/labeler.yml

@@ -1,4 +1,4 @@
-# path → scope:* map for actions/labeler — the PR half of LABELS.md's scope
+# path → scope:* map for actions/labeler — the PR half of .ceremony/LABELS.md's scope
 # story (issues are hand-scoped at triage; paths only exist on PRs). Additive
 # only: sync-labels stays off in labels.yml, so a hand-applied scope survives.
 "scope:cli":

.github/labels.conf

@@ -1,5 +1,4 @@
 panel=claude-bot-andresmgsl codex-bot-andresmgsl grok-bot-andresmgsl kimi-bot-andresmgsl
-triage-actors=dan-claude-bot
 scope:cli|C5DEF5|bin/box — the command surface
 scope:installer|C5DEF5|install.sh, versioned installs, upgrade/uninstall
 scope:host|C5DEF5|host/ — setup, teardown, firewall, isolation stack

.github/workflows/ci.yml

@@ -32,9 +32,9 @@ jobs:
         # `.github/` — and the whole release path (changelog-armed.sh, which
         # gates every PR, release-notes.sh, labels-reconcile.sh) went unlinted
         # while the comment above told the next author it was covered.
-        # Measured on this tree: dotglob adds exactly those three and nothing
-        # else — a checkout's `.git` carries no `*.sh` (its hooks ship as
-        # `*.sample`), so `**/*.sh` does not wander into it.
+        # Measured when this invariant was introduced: dotglob added exactly
+        # those three and nothing else — a checkout's `.git` carries no `*.sh`
+        # (its hooks ship as `*.sample`), so `**/*.sh` does not wander into it.
         #
         # The sweep below is the CLASS check, same shape as the eof_guard_sweep
         # in test/cli.sh (#112): the one-time fix is `dotglob`, but what keeps

.github/workflows/labels.yml

@@ -4,8 +4,6 @@ on:
   workflow_dispatch:                 # bootstraps missing labels on a fresh repo
   pull_request_target:
     types: [opened, reopened, ready_for_review, converted_to_draft, synchronize, labeled, unlabeled]
-  issues:
-    types: [opened, labeled, unlabeled, assigned, unassigned, closed]
 permissions:
   contents: read
   issues: write