fix: add retry and graceful fallback for rate-limited label API calls

- retries: 3 with 403 removed from exempt list so rate-limit responses
  are retried with backoff (octokit/plugin-retry respects Retry-After)
- Wrap addLabels call in try/catch so rate-limit failures emit a
  warning instead of hard-failing the job

.github/workflows/pull-request-target.yml

@@ -15,6 +15,8 @@ jobs:
     - name: Auto-label PR
       uses: actions/github-script@v8
       with:
+        retries: 3
+        retry-exempt-status-codes: 400,401,404,422
         script: |
           const branch = context.payload.pull_request.head.ref;
           const labels = new Set();
@@ -41,19 +43,23 @@ jobs:
               );
               if (files.some(f => f.startsWith('.github/'))) labels.add('repo');
             } catch (e) {
-              core.warning(`Could not list PR files (rate limited?): ${e.message}`);
+              core.warning(`Could not list PR files: ${e.message}`);
             }
           }
 
           if (labels.size > 0) {
             const labelArray = [...labels];
             core.info(`Applying labels: ${labelArray.join(', ')}`);
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: labelArray,
-            });
+            try {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                labels: labelArray,
+              });
+            } catch (e) {
+              core.warning(`Could not apply labels (rate limited?): ${e.message}`);
+            }
           } else {
             core.info('No labels matched for this PR.');
           }