CLDSRV-926: skip async/await diff check when PR has skip-async-migration label

[DarkIsDude]

Summary

• Adds pull-requests: read permission to the tests.yaml workflow
• The "Check async/await compliance in diff" step now checks whether the current branch's open PR carries the skip-async-migration label before running check-diff-async
• If the label is present the step exits cleanly; otherwise the check runs as before

Behaviour

Scenario	Result
PR has skip-async-migration label	Step skips, exits 0
PR does not have the label	check-diff-async runs normally
No open PR (direct push / workflow_dispatch)	check-diff-async runs normally

Pre-requisite

The skip-async-migration label must be created in the repository settings before use.

Closes CLDSRV-926

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
8472	1	8471	0

View the full list of 1 ❄️ flaky test(s)

"after each" hook for "should fail if trying to overwrite a delete marker"::MPU with x-scal-s3-version-id header With v4 signature "after each" hook for "should fail if trying to overwrite a delete marker"

Flake rate in main: 100.00% (Passed 0 times, Failed 4 times)

Stack Traces | 0.015s run time

We encountered an internal error. Please try again.

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[claude]

${{ github.ref_name }} is user-controlled (the branch name) and interpolated directly into a run: script, which is a script injection vector. The practical risk here is low since the workflow triggers on push (attacker already has write access) and permissions are read-only, but the standard hardening is to pass it through an env var instead of inline interpolation.

```suggestion
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
BRANCH_NAME: ${{ github.ref_name }}
run: |
if gh pr list --head "$BRANCH_NAME" --state open --json labels
--jq '.[].labels[].name' 2>/dev/null | grep -qx 'skip-async-migration'; then
echo "Skipping async/await check: 'skip-async-migration' label found"
else
yarn run check-diff-async
fi

[claude]

• Script injection: ${{ github.ref_name }} is interpolated directly into a run: block. Pass it through an env var instead for defense-in-depth.
  
  Review by Claude Code