Bug: CI Label pull request job fails on all fork PRs since #14411 #14438

Describe the bug

The Label pull request / add_label job fails on every pull request opened from a fork. The run is rejected at the environment gate before any step executes, with:

Branch "main" is not allowed to deploy to github-app-auth due to environment
protection rules. The deployment was rejected or didn't satisfy other protection rules.

The job fails in 1-2 seconds.

label-pr.yml runs on pull_request_target and declares environment: github-app-auth. On that trigger the workflow is evaluated in the context of the base branch (main), which appears not to satisfy the environment's protection rules. label-issues.yml and devflow-pr-review.yml declare the same environment.

Timing points to #14411 ("Replace workflow PAT usage with GitHub App authentication", merged Sep 11) as the origin — #14150 is a months-old PR whose add_label runs previously passed and now fail, with no change to its diff.

To Reproduce

1. Open a pull request from a fork against main.
2. Open the Checks tab and select Label pull request / add_label.
3. See the run fail in 1-2 seconds with the environment protection rule error above.

Affected (fork PRs): #14437, #14434, #14150.
Not affected (in-repo branch): #14393 (Dependabot) — no deployment failure, and the dependencies and python labels were applied normally.

Expected behavior

add_label runs to completion on fork PRs and applies the appropriate area labels, it did before #14411.

Screenshots
N/A

Platform

• Language: N/A (GitHub Actions workflow, not SDK code)
• Source: main branch of repository, at ca40aa7
• AI model: N/A
• IDE: N/A
• OS: N/A (ubuntu-latest runner)

Additional context

Side effect: incoming community PRs are not being auto-labeled, which may be affecting triage and none of the three affected PRs above carry area labels.