feat: protected labels enforcement with plane-aware authorization - #44664

Protected Labels Enforcement

Single workflow that enforces label-based authorization. If an unauthorized user applies a protected label, the bot removes it and posts a warning.

How it works

User applies a protected label on a PR
        |
        v
protected-labels.yaml triggers (pull_request_target: labeled)
        |
        v
check-label.js reads .github/protected-labels.yml from base branch
        |
        v
Is the label plane-aware? (management-plane / data-plane keys)
   YES --> detect plane from PR labels:
           Mgmt or resource-manager --> use management-plane approvers
           data-plane              --> use data-plane approvers
           neither                 --> skip (no enforcement)
   NO  --> use the flat approver list
        |
        v
Is user in the authorized list (+ global-approvers)?
   YES --> label stays
   NO  --> label removed + warning comment posted

protected-labels.yml is the single source of truth for label authorization. It supports:

• global-approvers - GitHub handles that can apply any protected label
• flat entries - same approvers regardless of plane context
• plane-aware entries - different approvers for management-plane vs data-plane PRs. Plane is detected explicitly via PR labels (no fallback).

Currently covers namespace approval labels. Other label types (breaking change, versioning) can be added once ownership is clarified with the ARM team.

Consolidation

Deletes .github/namespace-approvers.yml - namespace authorization now lives in protected-labels.yml using plane-aware entries. The namespace-approval workflow (validate-approval.js) focuses on business logic (pending/approved label transitions, status checks) and delegates auth to check-label.js.

Security

• Uses pull_request_target so config is always read from the base branch (prevents self-authorization)
• Trusted bots (github-actions[bot], azure-sdk) bypassed
• namespace-approved-all restricted to management-plane PRs only
• Case-insensitive GitHub handle matching