Closes #2412

Summary

Adds a feature-flagged granular tool batch_update_issue_labels that applies label changes to multiple issues in a single MCP call. Today the only path for bulk labeling is N sequential update_issue_labels calls, which is exactly the friction described in #2412 (label all issues from milestone X as priority/high forces either N noisy round-trips or dropping out of the MCP-first pattern to script the gh CLI).

Design

• Per-issue operations: each entry in operations targets one issue with add and/or remove label arrays. Labels not named in an operation are left untouched — this is add/remove semantics (POST/DELETE .../issues/{n}/labels), not replace semantics.
• Fail-closed input validation: empty operations, duplicate issue numbers, entries missing both add and remove, and empty label names fail the whole call before any mutation is attempted, with an index-addressed error (operations[2]: duplicate issue_number 7...) pointing at the exact entry.
• Per-issue API errors are isolated: if issue me/my/I function #3's API call fails but Port CLI Server #1 and HTTP Server #2 succeed, the result reports each outcome individually ({"issue_number":3,"applied":false,"error":"add failed: ..."}) instead of losing the successful work; overall result is marked as an error so the client knows to inspect it.

The add phase returns GitHub's full resulting label set per issue, so callers can verify final state without a follow-up read.

This follows the existing granular-tools pattern: registered in the issues toolset, gated behind FeatureFlagIssuesGranular, mutually exclusive with the consolidated issue_write.

Testing

• New handler tests (batch_labels_granular_test.go): happy path across two issues (one add + one remove, request bodies asserted), plus rejection cases for every validation rule and a partial-failure case asserting IsError + per-issue error text — 8 subtests, all passing.
• Registered in granular_tools_test.go toolset inventory + toolsnap snapshot committed.
• go build ./..., golangci-lint run pkg/github/...: no new findings on changed files (remaining hits pre-exist on clean main, verified by stash comparison).
• Full ./pkg/github/ suite: only failures are 6 environment-dependent golden snapshot tests that reproduce identically on clean main (Windows CRLF snapshot artifacts), untouched by this change.

Example

{
  "owner": "org",
  "repo": "repo",
  "operations": [
    {"issue_number": 10, "add": ["sprint-42"]},
    {"issue_number": 15, "add": ["breaking-change"], "remove": ["needs-triage"]},
    {"issue_number": 20, "remove": ["stale"]}
  ]
}