ci(proto-sync): fix upstream-impact tracking and include actionable diagnostics

[Verolop]

Background

The workflow that tracks failed proto-sync PRs failed on #575 with HTTP 403 while trying to label the pull request. It has issues: write and pull-requests: read, but calls addLabels before creating the tracking issue.

Failed workflow: https://github.com/multigres/multigres-operator/actions/runs/32021355267

#585 introduces proto-sync-reporting.yaml for sync-creation failures. Generated-PR CI must use the same reporter so one validated upstream SHA has one issue across both stages.

Scope

Remove PR labeling; the tracking issue already links the short-lived bot PR, and granting write access to pull requests is unnecessary. Keep the existing bot login, branch, repository, and upstream-SHA identity checks before passing data to the reporter.

On failed CI, update or create the SHA-keyed issue with the PR, upstream comparison, failed jobs, and concise failure details. On recovery, close that same issue. The observer must never check out or execute pull-request content.

Acceptance criteria

• Generated proto-sync PRs are authenticated with the existing bot, repository, branch, and SHA checks.
• Failed and recovered CI reuse the reporter from ci(proto-sync): restore first-attempt dependency synchronization #585 and update one issue per upstream SHA.
• Failure reports include the PR, upstream comparison, failed jobs, and useful diagnostics.
• The workflow uses only issues: write, pull-requests: read, and the read permission needed for workflow diagnostics.
• PR labeling and its label-bootstrap code are removed.

References

• Shared proto-sync reporter and sync-creation stage: ci(proto-sync): restore first-attempt dependency synchronization #585
• Proto sync PR: chore(deps): sync multigres proto to 3533683 #575
• Failed tracking workflow: https://github.com/multigres/multigres-operator/actions/runs/32021355267