* ci: gate invalid pull requests with CodeRabbit * fix: harden CodeRabbit PR hygiene gate * fix: make invalid PR label creation idempotent