ci(BA-4850): separate labeler workflow to fix 403 on fork PRs

[fregataa]

Summary

• Extract labeler job from ci.yml into standalone labeler.yml workflow
• Use pull_request_target trigger instead of pull_request to fix permission issues
• Fixes 403 "Resource not accessible by integration" errors on fork PRs

Test plan

• Quality checks pass (pants fmt, fix, lint)
• Verify labeler runs successfully on fork PR (will be tested after merge)

Resolves BA-4850

[Copilot]

Pull request overview

Extracts the PR labeler into its own workflow and switches to pull_request_target to avoid 403 permission errors on forked PRs.

Changes:

• Added a standalone .github/workflows/labeler.yml workflow triggered by pull_request_target.
• Removed the labeler job from .github/workflows/ci.yml.
• Configured concurrency and token permissions for the labeler workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/labeler.yml	New dedicated labeler workflow using pull_request_target with write perms for labeling.
.github/workflows/ci.yml	Removes embedded labeler job now handled by the standalone workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Using a third-party action pinned to a moving ref (@main) is risky, and this is especially sensitive with pull_request_target since the workflow runs with elevated permissions. Pin the action to an immutable commit SHA (preferred) or a version tag to reduce supply-chain risk.

Suggested change

	- uses: lablup/auto-labeler@main
	- uses: lablup/auto-labeler@v1

[Copilot]

Labeling a PR typically requires issues: write because PR labels are managed via the Issues API. With only pull-requests: write, the action may still hit 403s when trying to apply labels. Add issues: write (and keep pull-requests: write if the action needs it) to ensure labeling succeeds.

Suggested change

	contents: read
	contents: read
	issues: write