fix: go live on tier 1, self-provision ai:blocked

- on_issues_ai_triage.yaml: remove DRY_RUN entirely. AI_PR_TOKEN is now
  configured, tier 1 has been watched in dry-run, and the toggle was
  meant to be temporary scaffolding, not a permanent code path — verdicts
  now apply labels/comments unconditionally.
- daily_ai_fix.yaml: fold ai:blocked into the existing "ensure labels
  exist up front" step (renamed to reflect that). It was the one control
  label neither workflow ever created: the forbidden-paths guard applies
  it directly, and under set -euo pipefail a missing label there aborts
  that step's loop entirely, silently skipping every remaining PR behind
  the one that failed. No repo had hit this yet only because no label in
  the ai:*/ai-* namespace existed at all before now.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/daily_ai_fix.yaml

@@ -87,15 +87,19 @@ jobs:
 
       # Created up front so issue-fix.md's per-issue relabel never has to
       # improvise a color or retry a "label does not exist" error — that's a
-      # wasted turn multiplied by every issue in the batch.
-      - name: Ensure relabel targets exist
+      # wasted turn multiplied by every issue in the batch. Also covers
+      # ai:blocked, which the forbidden-paths guard applies later in this
+      # same job: with set -euo pipefail, `gh pr edit --add-label` on a
+      # label that doesn't exist yet fails and aborts that step's loop
+      # entirely, silently skipping every remaining PR behind it.
+      - name: Ensure control labels exist
         if: steps.batch.outputs.count != '0'
         env:
           GH_TOKEN: ${{ secrets.AI_PR_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
-          for l in ai:fixed ai:upstream ai:needs-human; do
+          for l in ai:fixed ai:upstream ai:needs-human ai:blocked; do
             gh label create "$l" --repo "$REPO" --color ededed --force >/dev/null 2>&1 || true
           done
 

.github/workflows/on_issues_ai_triage.yaml

@@ -24,9 +24,6 @@ concurrency:
 
 env:
   MAINTAINER: alexbelgium
-  # Leave "true" for the first couple of weeks. The verdict is printed in the
-  # job log and nothing is written to the issue. Flip when it looks right.
-  DRY_RUN: "true"
 
 jobs:
   classify:
@@ -120,12 +117,6 @@ jobs:
           [ "$VERDICT" = "addon-bug" ] && LABELS+=("ai-triage")
           LABELS+=("ai:classified")
 
-          if [ "${DRY_RUN:-true}" = "true" ]; then
-            echo "DRY_RUN: would apply labels: ${LABELS[*]}"
-            echo "DRY_RUN: would post comment:"; printf '%s\n' "$COMMENT"
-            exit 0
-          fi
-
           for l in "${LABELS[@]}"; do
             gh label create "$l" --repo "$REPO" --color ededed --force >/dev/null 2>&1 || true
           done