fix: don't tier-2 low-confidence verdicts; stop recoloring labels

Two findings from Codex review of #2899, both live now that DRY_RUN is gone:

- A low-confidence `addon-bug` had ai:needs-human set by the low branch and
  then ai-triage appended right back unconditionally, so it would enter the
  unattended tier-2 fix pass despite Rule 2 saying an uncertain call should
  only flag a human. Guard the ai-triage add on CONF != low.
- The label-create loop used `--force`, which updates existing labels; with
  a model-supplied cosmetic label like `bug` that already exists, triage
  recolored it to ededed as a side effect. Drop `--force` so existing labels
  are left untouched (create fails harmlessly via || true) while missing
  ones are still created.

tier 2's own label step keeps --force intentionally: its list is a fixed
set of workflow-owned ai:* labels meant to be gray, not model input.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/on_issues_ai_triage.yaml

@@ -127,11 +127,24 @@ jobs:
             LABELS=("ai:needs-human"); COMMENT=""
           fi
 
-          [ "$VERDICT" = "addon-bug" ] && LABELS+=("ai-triage")
+          # ai-triage is the tier-2 trigger, so it must never be added to a
+          # low-confidence verdict — Rule 2 of issue-classify.md says an
+          # uncertain addon/upstream call should only flag a human, not enter
+          # the unattended fix pass. (Above, low confidence already reset
+          # LABELS to ai:needs-human; this guard keeps ai-triage from being
+          # appended right back.)
+          if [ "$VERDICT" = "addon-bug" ] && [ "$CONF" != "low" ]; then
+            LABELS+=("ai-triage")
+          fi
           LABELS+=("ai:classified")
 
+          # No --force: an existing label (e.g. a model-supplied cosmetic
+          # "bug") must be left as-is. --force would update it, recoloring
+          # every such label to ededed as a side effect of triage. Without it,
+          # create fails harmlessly on labels that already exist (|| true),
+          # and still creates the workflow-owned ones the first time.
           for l in "${LABELS[@]}"; do
-            gh label create "$l" --repo "$REPO" --color ededed --force >/dev/null 2>&1 || true
+            gh label create "$l" --repo "$REPO" --color ededed >/dev/null 2>&1 || true
           done
           gh issue edit "$ISSUE" --repo "$REPO" \
             "${LABELS[@]/#/--add-label=}"