fix(ci): correct the labeler sync input; cover composite actions in dependabot

[iap]

Pull request

What changed

Two CI-layer defects found while auditing every action invocation against the action's own declared inputs, and re-checking what dependabot actually covers after #69.

1. Label sync never worked. labeler.yml passed syncLabels: true; the real input id is sync-labels. The runner logs Unexpected input(s) 'syncLabels' and the action falls back to its declared default (off) — so stale labels were never removed on synchronize, contrary to the step comment promising exactly that.
2. The shared build action was outside dependabot's scan. build(deps): bump the actions group with 4 updates #69's setup-uv bump updated every workflow and skipped .github/actions/build-package, leaving its pin behind — the exact silent rot dependabot.yml exists to prevent.

Affected surface

• tooling (tools/, CI, docs)
• generated package (pstack/) — requires a rebuild from the current pin

Provenance — required if pstack/ changed

n/a — no pstack/ change in this PR.

Verification

• uv run --frozen ruff check tools
All checks passed!
• uv run --frozen pytest -q
94 passed in 110.76s (0:01:50)
• uv run --frozen actionlint
exit 0
• uv run --frozen python tools/check_action_shell.py
composite action shell blocks: clean
• package rebuilt from the pin and git status shows the intended pstack/ diff
  n/a - no pstack/ change (diff is .github/, CHANGELOG.md, CONTRIBUTING.md only)
• poteto-mode scripts green, if touched (bun run test + bun run typecheck)
  n/a - not touched

Evidence for the labeler claim

Run 37394726141 (PR labels) log, verbatim:

##[warning]Unexpected input(s) 'syncLabels', valid inputs are ['repo-token', 'configuration-path', 'sync-labels', 'dot', 'pr-number']

Both v5 and v7 declare the kebab-case id; the v7 bump in #69 did not change it.
The audit that found this compared every uses: ref on main against that pin's declared inputs (fetched per-pin from the action repos) — it was the only mismatch in the repository.

Why the composite-action dependabot entry

The root github-actions entry scans .github/workflows plus a repo-root action.yml, not .github/actions/*/action.yml. Differential evidence: #69 moved astral-sh/setup-uv in ci.yml and model-drift-watch.yml and left .github/actions/build-package/action.yml at the old SHA. Directory-scoped entries are the established pattern (cf. actions/github-script dependabot.yml). The pin in that action is caught up to the SHA the workflows now use.

Notes for reviewers

• sync-labels: true is the intended behaviour: v6.1.0+ preserves manually-added labels while syncing, so this removes stale glob-matched labels without dropping human labels.
• Live-check note (corrected): pull_request_target executes the workflow from the base branch, so this PR's own label run still logs the Unexpected input warning — it ran main's copy. The fix takes effect for PRs opened after this merges; the warning's absence there is the live check.