bug: agent workflows fire on all PRs regardless of aw label

[microsasa]

Problem

review-responder and quality-gate workflows trigger on every pull_request_review:submitted event. The aw label check is only a soft guard in the agent prompt — the agent still activates, burns compute and inference tokens, then noops.

This means every human-authored PR that gets a Copilot review wastes agent runs.

Root cause

The roles: all setting (needed to work around gh-aw#21098) removes role-based filtering. Combined with pull_request_review as the trigger event, there is no pre-activation filter — the workflow fires for everyone.

The label check in the agent instructions (check if the PR has the aw label, if not stop) is a prompt-level guard, not an infrastructure guard. The agent job still runs, still does LLM inference, still burns tokens before it reaches the noop decision.

Impact

• Wasted CI minutes on every non-agent PR
• Wasted LLM inference tokens
• Unnecessary workflow runs cluttering the Actions tab

Fix

Use gh-aw's if: frontmatter field to add a job-level condition:

if: "contains(github.event.pull_request.labels.*.name, 'aw')"

This compiles to a GitHub Actions if: on the activation job — the workflow skips entirely at the runner level when the label is absent.

Discovered on

PR #118 — both agent workflows ran on a manually-created PR.

[microsasa]

Fixed in PR #119 (merged). Added if: frontmatter condition to both review-responder.md and quality-gate.md — workflows now skip entirely when aw label is absent.