Suggested test: copilot/add-labels-pull-requests-permission-opt-out

## Motivation

github/gh-aw#49477 — `safe-outputs.add-labels` gained `issues`/`pull-requests` boolean toggles so a workflow can opt out of `pull-requests: write` (e.g. `add-labels: { pull-requests: false }`), useful for least-privilege GitHub App installs that only grant `issues: write`. No existing test compiles or exercises this opt-out; `test-copilot-add-labels.md` uses default (both-scopes) behavior.

## Proposed test

- **Workflow file**: `test-copilot-add-labels-issues-only-permission.md`
- **Trigger**: `issues: [opened, reopened]` guarded by an `e2e-marker`, matching the existing `test-copilot-add-labels.md` pattern
- **Engine**: copilot
- **Safe output**: `add-labels` with `pull-requests: false`
- **Variant**: standard

## Minimal test prompt sketch

Same prompt as `test-copilot-add-labels.md` (add a label to the triggering issue), but with `safe-outputs.add-labels.pull-requests: false` in frontmatter. Assert the compiled lockfile's job permissions omit `pull-requests: write` while the label is still added successfully.

## New fixtures or secrets needed

None — same fixtures as `test-copilot-add-labels.md`.

## Notes

This is primarily a compile-time/permissions-shape regression (verifying `gh aw compile` emits the reduced permission set) plus a runtime smoke check that labeling still works without PR scope. Distinct from the existing `add-labels-issue-intents` open suggestion (#8128), which is about issue-intent behavior, not permission scoping.

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/30741299903) · auto · 36.4 AIC · ⌖ 7.01 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start by reading test-copilot-add-labels.md and the proposed test-copilot-add-labels-issues-only-permission.md pattern. Run gh aw compile and inspect the compiled lockfile permissions, then perform the runtime smoke check using the existing fixtures. Done means pull-requests: write is omitted while the triggering issue is still labeled successfully.

Written by the indexing model from the issue text.