feat: add test-copilot-update-pull-request-required-labels

> [!CAUTION]
> Protected files were modified in this change.
> This pull request is in `request_review` mode and requires explicit human scrutiny before merge.
>
> Protected files: `.github/workflows/test-copilot-update-pull-request-required-labels.md`

## Summary

Adds a regression test for github/gh-aw#44168, which fixed `update-pull-request` and `update-issue` silently ignoring `required-labels` and `required-title-prefix` safe-output filters at compile time.

## What the test does

1. Creates a pull request (via `create-pull-request` with `temporary_id: aw_rltpr`).
2. Immediately calls `update-pull-request` targeting that PR, with `required-labels: [copilot]` active.
3. The E2E harness verifies the update is applied and the filter constraint is respected.

## Notes

- Uses a `samples:` block so `--use-samples` mode works without live engine calls.
- Lock file intentionally omitted — to be generated by `gh aw compile` per AGENTS.md §4.

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `awmgmcpg`
>> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "awmgmcpg"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/28931505082) · 74.7 AIC · ⌖ 8.3 AIC · ⊞ 5.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+%22gh-aw-workflow-id%3A+suggest-new-e2e-tests%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** pushSignedCommits: refusing unsigned push for branch 'test-copilot-update-pull-request-required-labels-a4885ce3a7994383': Signed-commit payload violates file-protection policy (request_review): .github/workflows/test-copilot-update-pull-request-required-labels.md
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/githubnext/gh-aw-test/actions/runs/28931505082)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 28931505082 -n agent -D /tmp/agent-28931505082

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-28931505082/aw-test-copilot-update-pull-request-required-labels.bundle refs/heads/test-copilot-update-pull-request-required-labels:refs/bundles/create-pr-test-copilot-update-pull-request-required-labels-a4885ce3a7994383-55e39be9
git update-ref refs/heads/test-copilot-update-pull-request-required-labels-a4885ce3a7994383 refs/bundles/create-pr-test-copilot-update-pull-request-required-labels-a4885ce3a7994383-55e39be9
git checkout test-copilot-update-pull-request-required-labels-a4885ce3a7994383
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-test-copilot-update-pull-request-required-labels-a4885ce3a7994383-55e39be9

# Push the branch to origin
git push origin test-copilot-update-pull-request-required-labels-a4885ce3a7994383

# Create the pull request
gh pr create --title 'feat: add test-copilot-update-pull-request-required-labels' --base main --head test-copilot-update-pull-request-required-labels-a4885ce3a7994383 --repo githubnext/gh-aw-test
```