ci: Add lables via rest api

gh pr edit --add-label runs a GraphQL query that also fetches
org/login fields requiring `read:org`, which COMMAND_BOT_PAT doesn't
have. The REST labels endpoint only needs `public_repo`, matching the
label-creation step already using REST above it.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

.github/workflows/ai-policy.yml

@@ -139,9 +139,9 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
         run: |
-          gh pr edit "${{ github.event.pull_request.number }}" \
-            --repo "${{ github.repository }}" \
-            --add-label "AI assisted"
+          gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \
+            --method POST \
+            -f "labels[]=AI assisted"
           echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
 
       - name: Fail on coding-agent Signed-off-by