fix(github): label/assignee writes skip the installation-token retry every sibling GitHub-write helper uses

[JSONbored]

Context

src/github/assignees.ts's ensurePullRequestAssignee and src/github/labels.ts's ensurePullRequestLabel/removePullRequestLabel call createInstallationToken(env, installationId) directly. Every other GitHub-write helper in src/github/** — comments.ts, all 8 exported mutators in pr-actions.ts, repo-doc-pr.ts, e2e-test-commit.ts — wraps the same call in withInstallationTokenRetry (src/github/app.ts:174), which retries once with a freshly-minted token on a bad_credentials/permission-scope rejection. Label/assignee writes (invoked directly from agent-action-executor.ts and queue/processors.ts/review-evasion.ts, several of which further wrap the call in .catch(() => undefined)) will simply fail on a stale cached token instead of self-healing like every other GitHub write path.

Requirements

• Wrap the createInstallationToken calls in assignees.ts's ensurePullRequestAssignee and labels.ts's ensurePullRequestLabel/removePullRequestLabel in withInstallationTokenRetry, matching comments.ts/pr-actions.ts's exact usage.
• Do not change withInstallationTokenRetry itself, or any of the already-correct GitHub-write helpers.
• Verify the callers in agent-action-executor.ts/queue/processors.ts/review-evasion.ts still work correctly with the retry wrapper in place (their .catch(() => undefined) fallbacks should be unaffected, just now only triggered after a genuine retry failure instead of a first-try stale-token failure).

Test Coverage Requirements

99%+ Codecov patch coverage on the changed call sites; add a regression test proving a stale-token failure on a label/assignee write now retries with a fresh token and succeeds, mirroring an existing withInstallationTokenRetry test for comments.ts/pr-actions.ts.

Deliverables

• ensurePullRequestAssignee, ensurePullRequestLabel, removePullRequestLabel all wrapped in withInstallationTokenRetry.
• Regression test for the retry behavior.

Expected Outcome

Label and assignee writes self-heal on a stale cached installation token, the same way every other GitHub write path in this codebase already does.

Links & Resources

• src/github/assignees.ts, src/github/labels.ts
• src/github/app.ts:174 (withInstallationTokenRetry)
• src/github/comments.ts, pr-actions.ts, repo-doc-pr.ts, e2e-test-commit.ts (correct existing usage)

[linear-code]

JSO-4300