* [AI] Address zizmor findings on workflows
Replace actions-ecosystem/action-add-labels and action-remove-labels
with `gh` CLI calls (superfluous-actions). Silence the six
dangerous-triggers findings on pull_request_target/workflow_run
workflows with inline `# zizmor: ignore[dangerous-triggers]` and a
short rationale — each workflow already follows GitHub's documented
safe pattern (no PR code checkout, or validated artifacts only).
* [AI] Add release note for zizmor workflow fixes
---------
Co-authored-by: Claude <noreply@anthropic.com>
5565236ba7