fix: use label ID for Forgejo issue search and prevent duplicate labels

Forgejo's /issues?labels= filter requires integer IDs, not label names.
The workflow was searching by name (returning 0 results) then creating
a new issue every run.

Fix: look up label first, only create if missing, then use the ID for
both issue search and issue creation. This prevents both duplicate
issues and duplicate labels.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/workflows/upstream-sync.yml

@@ -68,14 +68,38 @@ jobs:
           echo "needs_sync=false" >> "$GITHUB_OUTPUT"
           echo "Already up to date with upstream"
         fi
+    - name: Ensure upstream-sync label exists
+      if: steps.compare.outputs.needs_sync == 'true'
+      id: label
+      run: |
+        API="${{ env.GITHUB_API_URL }}/repos/${{ github.repository }}"
+        AUTH="Authorization: token ${{ secrets.CLAUDE_BOT_TOKEN }}"
+
+        # Look up the label ID first (Forgejo needs integer IDs, not names)
+        LABEL_ID=$(curl -s -H "$AUTH" "$API/labels" | jq -r '[.[] | select(.name == "upstream-sync")] | .[0].id // ""')
+
+        # Only create label if it doesn't exist yet
+        if [ -z "$LABEL_ID" ]; then
+          curl -s -o /dev/null \
+            -X POST -H "$AUTH" -H "Content-Type: application/json" \
+            -d '{"name":"upstream-sync","color":"#0075ca","description":"Upstream sync tracking"}' \
+            "$API/labels"
+          LABEL_ID=$(curl -s -H "$AUTH" "$API/labels" | jq -r '[.[] | select(.name == "upstream-sync")] | .[0].id // ""')
+          echo "Created upstream-sync label with ID: $LABEL_ID"
+        else
+          echo "Found existing upstream-sync label ID: $LABEL_ID"
+        fi
+
+        echo "label_id=$LABEL_ID" >> "$GITHUB_OUTPUT"
     - name: Check for existing sync issue
       if: steps.compare.outputs.needs_sync == 'true'
       id: existing
       run: |-
+        # Forgejo's labels filter requires integer IDs, not names
         RESPONSE=$(curl -s \
           -H "Authorization: token ${{ secrets.CLAUDE_BOT_TOKEN }}" \
           -H "Content-Type: application/json" \
-          "${{ env.GITHUB_API_URL }}/repos/${{ github.repository }}/issues?state=open&labels=upstream-sync&limit=1")
+          "${{ env.GITHUB_API_URL }}/repos/${{ github.repository }}/issues?state=open&labels=${{ steps.label.outputs.label_id }}&limit=1")
 
         ISSUE_COUNT=$(echo "$RESPONSE" | jq 'length')
 
@@ -88,23 +112,6 @@ jobs:
           echo "issue_exists=false" >> "$GITHUB_OUTPUT"
           echo "No existing sync issue found"
         fi
-    - name: Ensure upstream-sync label exists
-      if: steps.compare.outputs.needs_sync == 'true'
-      id: label
-      run: |
-        API="${{ env.GITHUB_API_URL }}/repos/${{ github.repository }}"
-        AUTH="Authorization: token ${{ secrets.CLAUDE_BOT_TOKEN }}"
-
-        # Try to create the label (409 = already exists, which is fine)
-        curl -s -o /dev/null -w "%{http_code}" \
-          -X POST -H "$AUTH" -H "Content-Type: application/json" \
-          -d '{"name":"upstream-sync","color":"#0075ca","description":"Upstream sync tracking"}' \
-          "$API/labels" || true
-
-        # Look up the label ID (Forgejo needs integer IDs, not names)
-        LABEL_ID=$(curl -s -H "$AUTH" "$API/labels" | jq -r '[.[] | select(.name == "upstream-sync")] | .[0].id // ""')
-        echo "label_id=$LABEL_ID" >> "$GITHUB_OUTPUT"
-        echo "upstream-sync label ID: $LABEL_ID"
     - name: Create or update sync issue
       if: steps.compare.outputs.needs_sync == 'true'
       id: sync-issue