Summary

• stop the required CI workflow from running on each pull-request label change
• exempt Dependabot PRs from contributor changelog fragments
• calculate validation scope before Python setup so release-workflow-only dependency PRs finish without installing repository tooling
• read current PR labels so maintainers can apply skip-changelog and rerun a failed human-authored check
• remove overlapping pip scan directories that produced duplicate Dependabot PRs

Root cause

CI subscribed to labeled and unlabeled events even though Dependabot applies labels separately while opening a PR. The surviving run then required a Towncrier fragment from the bot. Separately, Dependabot's / pip scan already discovered nested requirement files, so listing /utils and the capability directories again caused duplicate update PRs.

Impact

A publishing-workflow-only Dependabot PR now receives one fast successful validate result plus dependency review. It does not install Python tooling, run the package suite, build the container, or require a changelog fragment. Human changes still receive the same scoped validation and changelog policy.

Validation

• actionlint across all workflows
• shell-condition checks for Dependabot, current skip-changelog, and normal human PR paths
• configuration diff and Towncrier fragment checks