Fail closed when Evergreen lease labels fail

[mrjf]

Summary:

• give Evergreen preflight PR write permission for controller-owned PR label mutations
• avoid unnecessary readiness label edits by checking current labels first
• make readiness and evergreen_active label failures explicitly set should_run=false instead of dispatching the agent without a lease
• verify evergreen_active after claiming it before setting should_run=true

Validation:

• gh aw compile evergreen --dir .github/workflows --validate --strict --approve --no-check-update --show-all
• gh aw lint --dir .github/workflows