Suggested test: copilot/add-labels-target-restriction

## Motivation

Link to the gh-aw PR: github/gh-aw#60362 — Enforce add-labels target restrictions

Previously the `add_labels` handler trusted model-provided item numbers over the configured `target`, allowing labels to be applied outside the triggering issue/PR. The fix now: defaults omitted targets to `triggering`; ignores model-provided item numbers for `triggering` and fixed numeric targets; only accepts model-selected targets when `target: "*"` is configured.

## Proposed test

- **Workflow file**: `test-copilot-add-labels-target-restriction.md`
- **Trigger**: `workflow_dispatch`
- **Engine**: copilot
- **Safe output**: `add-labels`
- **Variant**: standard

## Minimal test prompt sketch

Configure `safe-outputs.add-labels` with a fixed numeric `target` (or default `triggering`) and have the prompt instruct the agent to attempt to emit `add_labels` for a *different*, model-chosen item number. Assert the harness confirms the label lands only on the configured/triggering item, not the model-provided one — i.e. the override is ignored.

## New fixtures or secrets needed

None.

## Notes

Existing tests `test-copilot-add-labels.md` (issue-triggered) and `test-copilot-nosandbox-add-labels.md` / `test-copilot-siderepo-add-labels.md` cover the basic label-add path but not the target-restriction/enforcement behavior. Open suggestions #11353 (`add-labels-on-pull-request`) and #10716 (`add-labels-pull-requests-permission-opt-out`) cover different aspects and don't overlap with this scenario.

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/34683570501) · copilot · auto · 37.1 AIC · ⌖ 6.01 AIC · ⊞ 8.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start by comparing test-copilot-add-labels.md with test-copilot-nosandbox-add-labels.md and test-copilot-siderepo-add-labels.md, then create test-copilot-add-labels-target-restriction.md using the stated workflow_dispatch, copilot, and add-labels setup. Done means the harness confirms a model-selected different item is ignored for a fixed or default triggering target, with no fixtures or secrets required.

Written by the indexing model from the issue text.