ci: prevent issue-triage boilerplate from adding unrelated labels

[ebarti]

Problem

The issue-triage workflow scans the whole issue title and body with broad keyword rules. That makes safety boilerplate and contextual mentions look like affected product areas.

This issue reproduced the defect before it was rewritten: a documentation/onboarding request was automatically labeled for web, CLI/worker, security, docs, setup, and privacy review. It did not report a vulnerability or request fixes across those product areas.

The classifier currently lives in .github/workflows/issue-triage.yml.

Reproduction

1. Open an issue whose intended area is Documentation or Setup.
2. Mention a command such as jobctrl doctor, a “first useful screen,” and the standard warning not to post credentials or private data.
3. Wait for the Issue Triage workflow.
4. Observe unrelated area: web, area: cli-worker, area: security, and privacy: review-needed labels.

Expected behavior

• An explicit Issue Form area or regression-surface selection controls the area label.
• Standard safety and confirmation copy does not add unrelated area or privacy labels.
• Security-contact issues still receive area: security and privacy: review-needed.
• Blank issues without a structured area can still use a conservative keyword fallback.

Acceptance criteria

• Add regression fixtures for at least a Documentation selection, a Setup selection, a security-contact issue, and a blank issue.
• A Documentation fixture with CLI, screen, and privacy-boilerplate text receives area: docs, but not web, CLI/worker, security, or privacy-review labels.
• A Setup fixture receives area: setup without unrelated area labels.
• The security-contact fixture retains both security and privacy-review labels.
• The blank-issue fixture demonstrates the documented keyword fallback.
• Keep the classification logic testable outside GitHub Actions; implementation details are up to the contributor.
• corepack pnpm scripts:test passes.

Contributor notes

Please keep the patch scoped to triage classification and its regression tests. Do not weaken the public-issue privacy warnings or private vulnerability-reporting path.

Maintainer note: this issue originally asked a newcomer to produce a first-run report. That request belongs in Discussion #797; good first issue is reserved here for concrete fixes that can become a pull request.