Let only maintainers approve a CI exception: check the PR's label history

To let only specific maintainers waive a CI rule, have them add a label and check who added it, not just whether it's there: gh api --paginate repos/$REPO/issues/$PR/events | jq -rs 'add | map(select(.label.name? == "my-label")) | last | if .event == "labeled" then .actor.login else empty end', then match the login against an allowlist. Using the last event means a later unlabel revokes the approval, and jq -s 'add' merges the paginated pages. The workflow needs permissions: issues: read, GH_TOKEN set to github.token, and pull_request: types: [opened, synchronize, reopened, labeled, unlabeled] so adding the label re-runs CI. Separately: gh pr merge --admin can still fail with 'Squash merges are not allowed' or 'Merge commits are not allowed' because those are repo settings, not ruleset settings; check gh api repos/O/R --jq '{allow_squash_merge, allow_merge_commit, allow_rebase_merge}' first.