feat(review): connect the end-to-end labeling runner #5411

User Story

As an OpenShell maintainer observing labeling of accepted issues and PRs, I need one end-to-end runner using the shared /label-issue workflow so I can inspect and apply classifications before enabling automatic dispatch.

Description

Connect the deterministic helper from #5355 to the managed classifier adapter from #5407: prepare and check eligibility, expand required evidence, classify with the trusted skill and current result contract, validate, preview, and apply through the shared helper.

Accept one item number or URL. Keep preview and explicitly authorized application available through the same entry point. Human force bypasses only unchanged detection. An ineligible, excluded, or unchanged item must stop before model invocation; lookup failures must remain errors rather than negative decisions. Recheck current evidence and eligibility before writes.

Keep acceptance, validation, mutations, checkpoints, and reporting in the shared helper. Support evidence expansion without silently treating partial evidence as complete. Preserve label-event checkpoint verification and partial-failure recovery; do not blindly replay uncertain writes. Keep ambiguity in local reports and never post labeling comments. Consolidate the temporary request-preview CLI when introducing the actual runner.

Notional interaction: invoke /label-issue <number-or-URL> for a preview, inspect the proposed changes, and explicitly authorize one-item application. The runner also provides the same entry point for later automated callers; exact flags should follow the existing helper contract.

Context

• Parent: chore: create an invocable agent for workflow and topic labeling #5276. Depends on feat(skills): extract issue and PR labeling #5355 and feat(review): tools for labeling using Claude Managed Agents #5407; reuse feat(review): automatically label new PRs for accepted work #5260's accepted-work policy through the shared helper.
• chore: prepare area and topic labels for migration #5151's canonical labels, routing support, and the approved checkpoint label must be ready before corresponding live applications.
• This PR provides the runner, not acceptance-event workflows or unattended backlog execution. The acceptance-dispatch follow-up owns coordinated execution across entry points.

Human Prerequisites and Validation

Provision a dedicated CMA agent/environment, initial Sonnet-level configuration, trusted labeling identity, scoped credentials, and budget. Observe representative previews and one-item applications, including legacy migration, missing evidence, unchanged skips, force, and partial failures. Never commit credentials.

Definition of Done

• One entry point accepts an issue/PR number or URL and supports preview, authorized apply, and human force.
• Deterministic skips make no model call; evidence expansion, classification, and shared validation/application work end to end.
• No duplicate acceptance, label mutation, checkpoint, or result-schema implementation is introduced.
• Failures preserve execution references and distinguish stale inputs, missing prerequisites, and uncertain writes; no false successful checkpoint is recorded.
• Offline tests cover orchestration and failure boundaries; observed live runs verify the CMA configuration and actual helper contract.
• Document setup and the concise invoking-human report; do not enable automatic triggering in this PR.