chore(labels): restructure label taxonomy and wire advisory issues

[srothgan]

Summary

Reworks the repository labels into three consistent namespaces, aligns every .github file that depends on them, and restores the security-advisory notifications that were lost in #236.

Label changes applied via gh label (the repo now has 20 labels):

• Added: type: fix, type: security, status: triage, status: needs-info, area: tui, area: core, area: agent-sdk, area: install
• Renamed: type: enhancement → type: feature, type: quality → type: refactor, type: documentation → type: docs, release → type: release, blocked → status: blocked, discussion → status: discussion, wontfix → status: wontfix
• Removed: dependencies (duplicate of type: dependencies), duplicate (unused; GitHub has native duplicate marking), javascript (single-value outlier, replaced by area:)
• Recoloured: one colour family per namespace, resolving the type: enhancement/area: ci and type: documentation/release collisions

File changes in this PR:

• feature_request.yml now applies type: feature and status: triage
• dependabot.yml uses area: agent-sdk for both npm ecosystems instead of javascript
• dependency-monitor.yml labels the Agent SDK issue on both the create and the refresh path, and its advisory job now opens a labeled tracking issue
• CONTRIBUTING.md documents the namespaces and which labels automation depends on

Why

The old set was issue-shaped and had no label for a fix. Every fix(...) PR was tagged type: bug, which reads as "this PR is a bug" rather than "this PR fixes one" — and #312 ended up carrying both type: bug and type: enhancement because neither fit. Splitting type: bug (a reported defect) from type: fix (the change that resolves it) removes that ambiguity, and the type: values now mirror the conventional-commit types pr-title.yml already enforces.

Auditing the label wiring surfaced three unrelated defects, all fixed here:

1. bug_report.yml has always applied status: triage, but that label did not exist, so GitHub silently dropped it on every bug report. The label now exists.
2. All 19 RUSTSEC and yanked-crate issues plus the 6 Agent SDK monitor issues were unlabeled. They have been back-labeled, and both monitor jobs now label the issues they open.
3. type: enhancement and area: ci shared a colour, as did type: documentation and release, which defeated the point of the prefixes.

Advisory notifications

Tracing who opened the RUSTSEC issues turned up a regression. They came from actions-rust-lang/audit in .github/workflows/audit.yml, which #236 deleted on 2026-07-03 when advisory checking moved to cargo-deny. The replacement job runs continue-on-error: true and only writes to the job log, so nothing has surfaced an advisory since — the newest such issue is #218 from 2026-06-29.

This PR closes that gap on the cargo-deny side rather than restoring cargo-audit, because deny.toml is now the single source of advisory policy (yanked = "deny", unmaintained = "workspace"); reintroducing cargo-audit would report findings that policy deliberately scopes out. actions-rust-lang/audit also cannot label the issues it creates, so it could not satisfy this requirement anyway.

The job now installs cargo-deny directly instead of using EmbarkStudios/cargo-deny-action, because that action runs in a container and its report only reaches the job log. The action is unchanged and still Dependabot-tracked through the two pr.yml gates, so nothing loses pin coverage; the version pin here is manual and flagged in a comment, matching the existing cargo install mdbook --version 0.5.3 --locked in docs.yml.

Behaviour is one tracking issue that gets refreshed and self-closes, not one issue per advisory per run. The old action produced duplicates for the same advisory — #41/#56, #42/#57, #131/#132, #4/#5 are all pairs.

Closes #

Validation

• Automated: js-yaml parses dependabot.yml, dependency-monitor.yml, and both issue templates. Every run: block extracted from dependency-monitor.yml passes bash -n. Repo-wide grep confirms no reference to a removed or renamed label remains outside generated docs/book/ output.
• Manual: exercised the new advisory step locally against a stubbed gh across all four paths — findings with no open issue (creates, labeled type: security), findings with an open issue (edits, re-applies the label), clean with an open issue (closes with a comment), clean with none (no-op) — and confirmed the generated markdown renders with literal backticks and intact code fences. Verified the truncation guard caps a 60 KB report at a 50.5 KB body, under the 65536 character limit. Read all 15 .github files end to end; CODEOWNERS, config.yml, pull_request_template.md, and the 8 workflows other than dependency-monitor.yml contain no label references and are intentionally untouched. Re-labeled the 27 PRs that carried javascript and the 2 that carried dependencies before deleting those labels, so no item lost its only classification.
• Screenshot/video (if UI changed): N/A

Notes

• Breaking changes: N/A — renames preserve existing attachments, and saved filters or bookmarks using the old names will need updating.
• Docs updated: yes, CONTRIBUTING.md gains a Labels section.
• Governance/release impact: N/A
• The advisory job no longer sets continue-on-error: true. Advisories themselves are handled by the issue, so a red job now means the workflow itself broke, which is worth seeing.
• cargo install cargo-deny --locked adds a few minutes to this weekly job. That seemed a fair trade for a report in the issue instead of a log link that expires with the run.