fix(gitea-labels-milestones): read exclusive per label, never infer it

SKILL.md called `exclusive` "an org-labels-only flag" and concluded that
applying a Kind/*, Priority/* or Status/* label "must replace the one
already there, not stack on it". Live `list_repo_labels` on this repo
returns `exclusive` on every REPO label: all seven Kind/* plus
Compat/Breaking are false, while Priority/*, Reviewed/* and Status/* are
true. So the field is not org-only, and the replace rule would strip a
valid Kind/* label — a destructive write from a false premise.

The nuance kept: label_write's `exclusive` parameter genuinely is
annotated org-only, so that row was schema-accurate. The error was
generalising a write-parameter restriction into a claim about where the
field exists. The row is qualified rather than deleted.

The rule is now per-label: where exclusive is true the server drops the
sibling itself, so do not pre-remove; where it is false the label is
legitimately stackable.

Also fixes the org-label fallback, which treated any list_org_labels
failure as proof the owner is a user account with no org pool and said so
was "an answer, not an error to report". Under the token scopes this skill
declares the call fails with required=[read:organization] before any
org-vs-user determination is made, so a capability gap was being reported
as an absent label. Scope errors are now distinguished and reported.

Verified live against gitea-mcp v1.7.0, read-only calls.

Refs #99

plugins/gitea/.apm/skills/gitea-labels-milestones/references/label-inference.md

@@ -12,19 +12,24 @@ description) to this repo's `Kind/*` / `Priority/*` / `Status/*` label taxonomy.
 `gitea-issues` and `gitea-prs` before creating or updating an issue/PR, and directly when the user
 asks to label something without naming exact labels.
 
-## Scoped labels are mutually exclusive — replace, don't stack
+## Exclusivity is per label — read it, never infer it
 
-Each of `Kind/*`, `Priority/*`, `Status/*` is treated as a scoped-label group by convention (the `/`
-delimiter naming pattern). Gitea's `exclusive` flag — the mechanism that would let the server itself
-enforce one-label-per-scope — is documented as an org-labels-only setting, and the repo-level
-`label_write` methods used here don't accept it at all. So exclusivity within these scopes is a
-convention this skill enforces client-side, not something the server guarantees: applying a new
-label within a scope is expected to replace any existing label in that same scope on the target
-issue/PR, not add alongside it. When inference
-selects a `Priority/High` label and the issue already carries `Priority/Medium`, the write should
-result in only `Priority/High` remaining — use `replace_labels` scoped to that group's labels, or at
-minimum remove the superseded label before adding the new one. Never leave two labels from the same
-scope applied at once.
+Gitea's `exclusive` flag is a real per-label boolean returned by `list_repo_labels`, and where it is
+`true` the server enforces one-label-per-scope itself. It is not an org-only setting, and the `/`
+delimiter in a name says nothing about it. Verified on `Defame1297/holocron`: every `Priority/*`,
+`Reviewed/*` and `Status/*` label is `exclusive: true`, while every `Kind/*` label — and
+`Compat/Breaking` — is `exclusive: false` and is used stacked.
+
+So read each candidate label's own `exclusive` value from the resolution call and branch on it:
+
+- **`exclusive: true`** — the server drops the sibling on write. Add the label and let it; do not
+  pre-remove the label already there, and do not compute a replacement set client-side. Inferring
+  `Priority/High` onto an issue carrying `Priority/Medium` needs no special handling.
+- **`exclusive: false`** — **add alongside, never replace.** Stripping a co-existing label in the
+  same scope destroys a valid one: an issue can legitimately carry `Kind/Bug` and `Kind/Security`
+  at once.
+
+There is no client-side exclusivity convention for this skill to enforce.
 
 ## Signal → label mapping
 
@@ -57,16 +62,18 @@ scope applied at once.
 1. Read the conversation context (issue/PR title, body, or the triggering discussion) for the
    signals above.
 2. Call `label_read method: "list_repo_labels"` (see `references/labels.md`) to get the current
-   label set with IDs — inference must never guess an ID, only a name, then resolve it. Because
-   `exclusive` is an org-labels-only flag, this taxonomy plausibly lives at org scope too: for any
-   inferred name absent from the repo pool, also call `label_read method: "list_org_labels"` with
-   `org` set to the repo's `owner` before treating it as unresolved. A failure there means the owner
-   is a user account, not an organisation, so no org pool exists and the name is genuinely absent.
-3. Match inferred label names against the resolved list (case-insensitive). If a scope group
-   already has a different label applied on the target and a new one is inferred for that same
-   scope, plan to replace rather than add (see above).
+   label set with IDs and each label's `exclusive` value — inference must never guess an ID, only a
+   name, then resolve it. Both pools can apply to one issue, so for any inferred name absent from
+   the repo pool, also call `label_read method: "list_org_labels"` with `org` set to the repo's
+   `owner` before treating it as unresolved. Read that call's failure text: a
+   `required=[read:organization]` scope error means the org pool was never queried — report the
+   missing token scope rather than reporting the label unresolved. Only a not-found response means
+   there is no org pool and the name is genuinely absent.
+3. Match inferred label names against the resolved list (case-insensitive) and carry each match's
+   `exclusive` value forward: `true` means the server replaces the sibling on write, `false` means
+   the label is added alongside whatever is already applied (see above).
 4. **Low-confidence inference omits the label.** If no signal confidently maps to a `Kind/*` value,
    do not guess — omit `Kind/*` entirely rather than default to one. `Priority/Medium` is the one
    exception: it's the explicit default when no urgency signal is present, not a guess.
-5. Hand the resolved IDs (plus which scopes to replace) to the caller's `issue_write`/
+5. Hand the resolved IDs, each with its `exclusive` value, to the caller's `issue_write`/
    `pull_request_write` call — this skill does not apply labels to an issue or PR itself.