refactor(ci): DRY the retried label-fetch into a composite action

Address @ethernet8023's review nits (both flagged non-blocking):

- Extract the copy-pasted retried `gh pr view` label-fetch loop (lint.yml
  ci-review gate + supply-chain-audit.yml mcp-catalog gate) into a single
  .github/actions/gh-pr-labels composite action. It preserves the exact
  semantics the reviewer verified: retry on transient API failure, exit 1
  after N attempts (re-runnable), and a clean fetch that simply lacks the
  label reports has-label=false rather than hard-failing. Both gates now
  consume the has-label output.
- Rewrite the Dockerfile playwright retry from the compact
  `&& break || { ... }` one-liner into the readable multi-line if/sleep
  form used everywhere else.

E2E-verified the composite action against a stubbed gh across four cases:
label present -> has-label=true; absent -> has-label=false; API always
fails -> exit 1 + annotation, no output written; transient (fail-once) ->
recovers and reports true. All workflow/action YAML parses; bash -n clean.

.github/workflows/lint.yml

@@ -177,29 +177,19 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Require ci-reviewed label
-        id: label-check
+      - name: Fetch ci-reviewed label
+        id: labels
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: ./.github/actions/gh-pr-labels
+        with:
+          pr: ${{ github.event.pull_request.number }}
+          required-label: ci-reviewed
+      - name: Require ci-reviewed label
+        id: label-check
         run: |
           set -euo pipefail
-          PR="${{ github.event.pull_request.number }}"
-          # Retry the label fetch: a transient API blip must not read as
-          # "label absent" (which hard-fails the job below on a PR that
-          # actually carries the label).
-          LABELS=""
-          for i in 1 2 3; do
-            if LABELS=$(gh pr view "$PR" --json labels --jq '.labels[].name'); then
-              break
-            fi
-            if [ "$i" = 3 ]; then
-              echo "::error::Could not fetch PR labels after 3 attempts (GitHub API failure — re-run this job)."
-              exit 1
-            fi
-            echo "::warning::gh pr view failed (attempt $i); retrying in 10s"
-            sleep 10
-          done
-          if echo "$LABELS" | grep -Fxq 'ci-reviewed'; then
+          if [ "${{ steps.labels.outputs.has-label }}" = "true" ]; then
             echo "reviewed=true" >> "$GITHUB_OUTPUT"
             echo "ci-reviewed label present."
             exit 0

.github/workflows/supply-chain-audit.yml

@@ -238,27 +238,21 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Fetch mcp-catalog-reviewed label
+        id: labels
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: ./.github/actions/gh-pr-labels
+        with:
+          pr: ${{ github.event.pull_request.number }}
+          required-label: mcp-catalog-reviewed
+
       - name: Require explicit MCP catalog review label
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          PR="${{ github.event.pull_request.number }}"
-          # Retry the label fetch so an API blip doesn't read as "label
-          # absent" and falsely block the PR.
-          LABELS=""
-          for i in 1 2 3; do
-            if LABELS=$(gh pr view "$PR" --json labels --jq '.labels[].name'); then
-              break
-            fi
-            if [ "$i" = 3 ]; then
-              echo "::error::Could not fetch PR labels after 3 attempts (GitHub API failure — re-run this job)."
-              exit 1
-            fi
-            echo "::warning::gh pr view failed (attempt $i); retrying in 10s"
-            sleep 10
-          done
-          if echo "$LABELS" | grep -Fxq 'mcp-catalog-reviewed'; then
+          if [ "${{ steps.labels.outputs.has-label }}" = "true" ]; then
             echo "MCP catalog review label present."
             exit 0
           fi