[w4] Label every fleet PR with its org-structure role (#526)

Pure derive_pr_labels (foundation/policy/pr_labels.py) maps a PR's shape
to a stable org-structure label set: to master/to slave (is_root_pr
discriminator), root, MegaTask, and the owning layer (main-pm /
cell/{team} / subtask/{team}). Mirrors batch.py: object|None inputs,
enum-or-string normalization, no DB/I/O. Full slave-targeting semantics
(base_branch vs default_branch) land with the slave/master wiring (W-H);
YAGNI now.

GitService._apply_pr_labels posts the result to the GitHub labels API
best-effort (create-before-add, swallow 422/409, never raises) so a label
failure can never block PR creation. Wired at all three PR-opening sites:
create_pr (gateway path), create_pull_request (REST/task path), and
_push_and_open_conventions_pr (static chore label). Existing PR tests
mock _apply_pr_labels so they never hit the real labels API.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/services/test_git.py

@@ -503,6 +503,7 @@ async def test_create_pr_returns_pr_dict() -> None:
         "html_url": f"https://github.com/acme/repo/pull/{_EXPECTED_PR_NUMBER}",
     }
     _bind(svc, "_post_pr", AsyncMock(return_value=fake_resp))
+    _bind(svc, "_apply_pr_labels", AsyncMock())
 
     with _patch_project_service(fake_project):
         out = await svc.create_pr(
@@ -550,6 +551,7 @@ async def test_create_pr_records_pr_despite_cancellation_after_post() -> None:
         "html_url": f"https://github.com/acme/repo/pull/{_EXPECTED_PR_NUMBER}",
     }
     _bind(svc, "_post_pr", AsyncMock(return_value=fake_resp))
+    _bind(svc, "_apply_pr_labels", AsyncMock())
 
     with _patch_project_service(fake_project):
         task = asyncio.ensure_future(
@@ -607,6 +609,7 @@ async def test_create_pr_cancellation_waits_out_record_before_reraising() -> Non
         "html_url": f"https://github.com/acme/repo/pull/{_EXPECTED_PR_NUMBER}",
     }
     _bind(svc, "_post_pr", AsyncMock(return_value=fake_resp))
+    _bind(svc, "_apply_pr_labels", AsyncMock())
 
     with _patch_project_service(fake_project):
         task = asyncio.ensure_future(