Phase 1: Add org-wide PR template, labels, and reusable workflows

[bryanbeverly]

Summary

This is Phase 1 of the PR Labeling & Hygiene plan -- it populates trufflesecurity/.github with the building blocks the other 7 private repos will call.

What this PR adds:

File	Purpose
.github/PULL_REQUEST_TEMPLATE.md	Default PR template inherited by every repo without its own
labels.yml	Single source of truth for the 11-label taxonomy (size/*, risk/*, review/urgent, status/stale, complexity/high)
.github/workflows/pr-labeler-reusable.yml	Reusable workflow: applies size/risk/checkbox labels
.github/workflows/label-sync-reusable.yml	Reusable workflow: syncs labels.yml into a caller repo
.github/workflows/stale-reusable.yml	Reusable workflow: wraps actions/stale@v9 (14d stale, 16d close, exempts review/urgent and drafts)
.github/scripts/pr_labeler.py	Labeler logic: size buckets, Bugbot risk parsing, checkbox state
.github/scripts/label_sync.py	Label sync logic via gh label create --force (additive)
.github/scripts/test_pr_labeler.py	35 unit tests for labeler logic
.github/workflows/test-scripts.yml	Runs unit tests on PRs and pushes
README.md	Documents what lives here, perms model, how to add a label

Permissions model: No reusable workflow declares its own `permissions:` block -- they inherit from callers. Each consumer caller declares the minimum its reusable needs (documented in README and the plan).

Versioning: Caller workflows reference these reusables at `@main`. Pushes to this branch immediately affect every consumer once they merge their callers (Phase 2). Branch protection on `main` requires PR review.

Required follow-up after merge (manual UI steps)

Both must be done by an org admin in the GitHub web UI:

1. Enable Actions access for org repos: `Settings > Actions > General` for this repo -> "Access" section -> "Accessible from repositories in the 'trufflesecurity' organization." Without this, callers in other repos cannot reference these reusable workflows.
2. Set org default labels: `Organization settings > Repository defaults > Repository labels` -> replace GitHub's defaults with the 11 labels from `labels.yml`. This applies only to future repos in the org; existing repos are populated by the sync workflow in Phase 2.

Test plan

• All 35 unit tests pass locally (covering size buckets, Bugbot risk regex incl. unmapped levels, three-state checkbox parsing, label reconciliation that doesn't strip manual labels)
• All YAML files parse cleanly
• Test-scripts CI workflow runs green on this PR
• (Post-merge) Phase 2 caller PRs successfully reference these reusables

Phase 2 preview

Once this merges + the two UI steps are done, separate PRs will land per repo to:

1. Add a thog-specific PR template extension; delete integrations' empty template
2. Add sync-labels.yml caller in each of 7 repos, then trigger sync to populate the 11 labels
3. Add pr-labeler.yml caller in each of 7 repos
4. Backfill labels on all 239 open PRs
5. After Slack announcement, add stale.yml caller in each of 7 repos

Plan reference: `/Users/bryan.beverly/.cursor/plans/pr_labeling_and_hygiene_5b9ac6e6.plan.md`

Made with Cursor

---

Note

Medium Risk
Introduces org-wide GitHub Actions that can mutate labels and auto-close PRs across consumer repos; misconfiguration or regex/threshold mistakes could cause incorrect labeling or unintended staling once adopted org-wide.

Overview
Adds org-level PR hygiene building blocks: a default PULL_REQUEST_TEMPLATE.md, a centralized labels.yml taxonomy, and reusable workflows to sync labels, auto-label PRs, and mark/close stale PRs.

Implements Python automation to (1) sync labels into a target repo via gh label create --force (additive) and (2) label PRs based on diff size, Bugbot CURSOR_SUMMARY risk parsing, and PR-template checkboxes, with unit tests plus CI workflows for pytest, ruff, and actionlint.

^{Reviewed by Cursor Bugbot for commit a191d1f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bryanbeverly]

Reopening as a fresh PR with clean (single-commit) history -- the original branch's intermediate commit publicly enumerated the 7 internal consumer repo names in the README diff. Replacement PR coming next with identical final state.