Review events on fork PRs run with a read-only token, so labels can't be added from the pull_request_review trigger. Move label-adding to a daily scheduled scan, which also covers PRs with merge conflicts. The event-driven workflow now handles removal only.