# Label Management Fix - Automation Tracking Issue

## Problem
After implementing strict label restrictions, automation tracking issues were not getting their "Automation Tracking" label because:
1. We blocked `forgejo_add_issue_labels` for all agents except forgejo-label-manager
2. The automation-tracking-manager creates issues via bash/curl and needs to add labels immediately
3. It cannot invoke the forgejo-label-manager from within a bash script context

## Solution
Made a targeted exception for the automation-tracking-manager:

### 1. Allowed forgejo_add_issue_labels for automation-tracking-manager
```yaml
forgejo:
  "*": allow
  # CRITICAL: Label creation is COMPLETELY FORBIDDEN
  "forgejo_create_label": deny
  "forgejo_create_org_label": deny
  "forgejo_create_repo_label": deny
  # EXCEPTION: automation-tracking-manager needs to add "Automation Tracking" label
  "forgejo_add_issue_labels": allow
```

### 2. Removed overly broad bash restrictions
The automation-tracking-manager is a trusted system component that only adds the existing "Automation Tracking" label to issues it creates. We removed the bash restrictions that were blocking the `/api/v1/repos/{owner}/{repo}/issues/{index}/labels` endpoint.

### 3. Updated the label application code
The automation-tracking-manager now properly adds the label using curl after creating the issue:
```bash
curl -s -X POST "https://git.cleverthis.com/api/v1/repos/${repo_owner}/${repo_name}/issues/${issue_number}/labels" \
  -H "Authorization: token $FORGEJO_PAT" \
  -H "Content-Type: application/json" \
  -d '{"labels": ["Automation Tracking"]}' > /dev/null
```

## Why This Is Safe
1. The automation-tracking-manager is a critical system component
2. It only adds ONE specific label: "Automation Tracking"
3. This label must already exist at the organization level
4. The agent cannot create new labels (those endpoints remain blocked)
5. This is the only agent that needs this exception due to its unique bash-based implementation

## Other Agents
All other agents that need to add labels should continue to use the forgejo-label-manager subagent. The automation-tracking-manager is a special case because it operates primarily through bash scripts and creates system tracking issues.