chore(ci): emit claude:review:passed/failed label from automated PR review [PYSDK-105]

Adds a machine-readable verdict from the automated Claude PR review so
branch-protection rules can gate `auto-merge` on the review outcome
without human intervention.

Changes:
* `.github/labels.yml`: two new mutually-exclusive labels
  - `claude:review:passed` (green) — no blocking findings on current head
  - `claude:review:failed` (red)   — blocking findings on current head
* `.github/workflows/claude-code-automation-pr-review.yml`: extend prompt
  with a mandatory "Machine-Readable Verdict" final step. Claude must
  emit PASS or FAIL based on the existing CRITICAL CHECKS criteria
  (test markers, coverage ≥85%, lint clean, conventional commits,
  architecture/security) and apply the corresponding label via
  `gh pr edit --add-label ... --remove-label ...`. The opposite label
  is always removed, so the labels stay mutually exclusive across
  re-reviews on subsequent pushes.

Re-emission: every push to a PR re-runs the review (existing
`synchronize` trigger), so the verdict is always tied to the current
head commit — stale verdicts cannot persist.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: helmut-hoffer-von-ankershoffen

.github/labels.yml

@@ -117,6 +117,14 @@
   description: Trigger Claude Code automation
   color: "b41d8f"
 
+- name: claude:review:passed
+  description: Automated Claude PR review found no blocking issues on the current head commit
+  color: "0e8a16"
+
+- name: claude:review:failed
+  description: Automated Claude PR review found blocking issues on the current head commit
+  color: "b60205"
+
 - name: copilot
   description: GitHub Copilot related
   color: "e6dac6"

.github/workflows/claude-code-automation-pr-review.yml

@@ -214,6 +214,49 @@ jobs:
 
         Use `gh pr comment` with your Bash tool to leave your comprehensive review as a comment on the PR.
 
+        ## Machine-Readable Verdict (MANDATORY)
+
+        After posting your review comment, you MUST emit a single-label verdict on the PR. This label is consumed by branch-protection rules to gate auto-merge — it is the only deterministic signal of your review outcome.
+
+        **Verdict criteria** (all must hold for PASS):
+
+        - No blocking findings under "CRITICAL CHECKS" — i.e. no missing test markers, no coverage drop below 85%, no `make lint` failures, no conventional-commit violations.
+        - No blocking architecture or security violations under "Repository-Specific Review Areas".
+        - Suggestions / nice-to-haves do NOT block the verdict.
+
+        If any blocking finding remains: verdict is **FAIL**.
+        Otherwise: verdict is **PASS**.
+
+        **Apply the label** (the two labels are mutually exclusive — always remove the opposite one):
+
+        ```bash
+        # PASS:
+        gh pr edit ${{ github.event.pull_request.number }} \
+          --add-label "claude:review:passed" \
+          --remove-label "claude:review:failed"
+
+        # FAIL:
+        gh pr edit ${{ github.event.pull_request.number }} \
+          --add-label "claude:review:failed" \
+          --remove-label "claude:review:passed"
+        ```
+
+        Note: `--remove-label` is a no-op if the label is not present, so it is safe to always include it.
+
+        Also include the verdict as the final line of your sticky review comment, formatted exactly as:
+
+        ```
+        **Verdict**: ✅ claude:review:passed
+        ```
+
+        or
+
+        ```
+        **Verdict**: ❌ claude:review:failed
+        ```
+
+        This makes the verdict visible to humans without scrolling through all findings.
+
         ---
 
         **Remember**: This is medical device software. Insist on highest standards. Be thorough, actionable, and kind.