* fix(ci): query check runs instead of commit statuses for CLA labels
The CLA Assistant action (contributor-assistant/github-action) reports
results as check runs, not commit statuses. The labeling step was
querying listCommitStatusesForRef which always returned an empty array,
so CLA labels were never applied to PRs.
Switch to checks.listForRef and match on the CLAssistant check run name
and conclusion. Add checks: read permission.
* fix(ci): split CLA labeling into separate job to avoid race condition
The label step was in the same job as the CLA check, so the CLAssistant
check run was still in_progress when queried — labels were never applied.
Move labeling to a separate job with needs: CLAssistant so the check run
is completed before we read its conclusion.
Also add issues: write permission for creating repo-level labels.
f5d0e8dd17