ci: add tool constraints to pr-severity prompt

[Roasbeef]

The pr-severity workflow has been posting severity classification comments on PRs but never actually applying the labels. Every single run shows the same pattern: Claude tries to use gh api to add labels, the allowed tools restriction correctly denies it, but then Claude silently gives up instead of retrying with the permitted gh pr edit --add-label command.

You can see this across multiple PRs -- #10529, #10472, #10538, #10540 all have severity comments but zero severity labels. The permission_denials array in the run output confirms gh api attempts were blocked each time.

This adds an explicit "Tool Constraints" section at the top of the prompt that tells Claude upfront it only has gh pr view, gh pr edit, and gh pr comment. By making the available tools clear before any instructions, Claude should use gh pr edit --add-label directly instead of attempting gh api first.

Failed run that surfaced this: https://github.com/lightningnetwork/lnd/actions/runs/21614145381/job/62289184152

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[lightninglabs-deploy]

🟢 PR Severity: LOW

CI/CD Configuration | 1 file | 12 lines changed

🟢 Low (1 file)

• .github/workflows/pr-severity.yml - GitHub Actions workflow configuration

Analysis

This PR modifies only CI/CD configuration in the .github/ directory. According to the severity classification rules, changes to .github/* (CI/CD configuration) are categorized as severity-low and require best-effort review.

The change adds tool constraints to the pr-severity prompt workflow, which is a meta-improvement to the CI/CD pipeline itself. This has no impact on:

• Lightning Network protocol operations
• Wallet or channel management
• Payment routing or HTLC forwarding
• Key management or security-critical code
• Database operations

No severity bump required:

• Single file changed (threshold: >20 files)
• Only 12 lines added (threshold: >500 lines)
• No critical packages touched

---

_{To override, add a severity-override-{critical,high,medium,low} label.}