Fix external plugin approval label normalization

[Copilot]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, or workflow file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, or workflow with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the staged branch for this pull request.

---

Description

The merged-PR label normalization step in .github/workflows/external-plugin-approval-command.yml was failing under the default Actions token. This updates the workflow to stop creating repository labels at runtime while preserving the PR label cleanup path.

• Failure path

  • removes the inline createLabel call for approved, which is the unsafe part of the current flow for this event/token context

• Workflow permissions

  • adds pull-requests: write so the remaining PR label mutations run with the expected scope

• Behavior preserved

  • still adds approved to the merged external-plugin PR when missing
  • still removes stale labels: awaiting-review, awaiting-approval, ready-for-review, rejected

permissions:
  issues: write
  pull-requests: write

if (!labelNames.has('approved')) {
  await github.rest.issues.addLabels({
    owner: context.repo.owner,
    repo: context.repo.repo,
    issue_number: prNumber,
    labels: ['approved']
  });
}

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• Update to existing instruction, prompt, agent, plugin, skill, or workflow.
• Other (please specify):

---

Additional Notes

This change is intentionally limited to the approval workflow; no other external-plugin automation paths were modified.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.