Make PR Tooling Safety Check resilient to GitHub MCP list_pull_requests timeouts

[Copilot]

The labelops-pr-security-scan workflow repeatedly aborts with report_incomplete when the GitHub MCP server times out (module closed with context deadline exceeded) while listing open PRs in one shot. The agent treats a single transient timeout as terminal, which generates a failure issue every run.

Changes

All edits are to the prompt body of .github/workflows/labelops-pr-security-scan.md (no logic/lock changes — the body is {{#runtime-import}}-ed, so the compiled .lock.yml is unchanged):

• Bounded PR listing (process step 3) — paginate with perPage: 30, sort newest-first, and stop paginating once a page reaches a PR older than the existing 2026-05-12 cutoff. This keeps each call small enough to stay under the MCP deadline instead of fetching the entire open-PR set at once.
• Transient-failure tolerance (new rule 7 + step 3 note) — retry timeout/transport errors (context deadline exceeded, module closed, EOF) up to 3 times before giving up; skip a single unreadable PR and continue rather than aborting the whole scan; only report_incomplete after retries are exhausted.

Notes

• Early-stop pagination stays consistent with the memory-prune step: memory only ever holds PRs newer than the cutoff, all of which appear in the newest-first list, so pruning still correctly detects merged/closed entries.