[webup]

Description

Integrate the two already reviewed workflow-startup fixes independently of #19. The label-maintenance workflow uses pull_request_target, so GitHub loads its trusted default-branch definition; a replacement inside #19 cannot repair that old definition for its own synchronize events.

Remove the four inapplicable Primus frontend calls that request OIDC during reusable-workflow validation, even behind a false condition. The retained local frontend suites are upstream-only; downstream headless source qualification stays with Go/query CI. Replace the Primus label helper with repository-token metadata cleanup that checks no source out and executes no PR-controlled code.

Validation

Both complete workflow files are byte-identical to the independently reviewed implementation in #19 commit 39dc9210d415967d178ec6a1ca2487f0072e7be1. Actionlint passed; 14 controlled workflow/provenance tests and the independent review passed for that implementation. The label API accepts the scoped pull-requests: write permission.

Additional Information

This changes two workflow files only, based on current main e8cbe64de06a6fabeb9ca6f48c274abad940a0ce. No business source, lint rules, repository visibility, package, Release or alias changes. This PR qualifies workflow startup/metadata handling; the inherited Go guard on main still skips same-repository fork PRs until #19. Full source, the accepted historical lint baseline, generated OpenAPI and a fixture race repair continue in #19.

[webup]

Thanks for the workflow cleanup. Both complete files match the independently reviewed implementation in #19; actionlint and 14 controlled contract tests passed. This is a metadata/startup bootstrap only, with no Go source or package changes.

The inherited Go workflow still has a startup failure in run 41613150619; its definition is unchanged by this PR and is replaced in #19. That failure is retained as missing Go qualification, not called passing. Integrating the trusted default-branch label helper first lets #19's final source CI execute against the repaired metadata definition. No administrator override or additional permission-policy changes are part of this integration.