Add issue triager: auto-label and auto-assign new issues

[huzaifa-d]

• I have signed the Contributor License Agreement.
• This pull request is related to an issue.
• If this PR changes build commands, project architecture, or key conventions, I have updated .github/copilot-instructions.md.

---

Summary

Adds an issue-triage GitHub Action and consolidates overlapping label logic out of the policy service into it, so triage labeling + assignment has a single owner.

New: issue-triage Action

On issue opened / edited / assigned:

1. Auto-labels via github/issue-labeler@v3.4 using regex on title + body → OS-*, Container-*, Area-*. Patterns derived from previously triaged issues. Each label uses a single OR-alternation regex (the action ANDs multiple list entries).
2. Auto-assigns area owners via actions/github-script@v7 (keyword match on title + body).
3. Removes Needs-Triage once auto-triaged — an area label was applied or an owner is assigned.

File	Purpose
.github/labeler.yml	Regex → label config
.github/workflows/Issue.Labeler.yml	Labeler + assignment + Needs-Triage removal

Assignee mapping

Area keywords	Owner
network, firewall, iptables, proxy, dns, tcp/udp, ipv4/6	@bbonaby
linux, wslc, wsl, lxc, bubblewrap	@SohamDas2021
appcontainer, base container, process isolation/container	@jsidewhite
microvm, nanvix, hyperlight, windows sandbox	@huzaifa-d
session isolation	@adpa-ms
macos, darwin, seatbelt, xcode	@richiemsft

Policy service consolidation

To avoid two systems doing overlapping triage, the following moved from .github/policies/ into the Action:

• Removed the OS-Linux/MacOS/Windows rules from labelManagement.issueOpened.yml — the Action's regex applies OS-* across all issue types, not just Bug reports.
• Deleted labelManagement.issueAssigned.yml — its only task removed Needs-Triage on assign. The Action now triggers on assigned and clears Needs-Triage there, preserving the behavior for manual assignments too.

The policy service keeps all unrelated behavior: adding Needs-Triage on open, Issue-* type labels, close cleanup, the author-feedback flow, and PR labelSync.

Design notes

• sync-labels: 0 — labels are only added, never removed, so human triage decisions are preserved.
• Issue-* type labels stay with the templates/policy (out of scope here).
• No self-trigger loop: GITHUB_TOKEN actions cannot recursively trigger workflows, so the Action's own addAssignees/label changes don't re-run it; only human events do.
• The regex config and assignment logic were adversarially reviewed by two independent cross-family models (GPT-5.5 and Gemini 3.1 Pro), which caught and fixed an AND-vs-OR semantics bug in the initial labeler config.

cc @SohamDas2021 (original author of the .github/policies/ label management) for review of the consolidation.

[Copilot]

Pull request overview

Adds an issue-triage GitHub Actions workflow to automatically apply area/OS/backend labels (via github/issue-labeler) and auto-assign likely area owners (via actions/github-script) when issues are opened or edited.

Changes:

• Introduces .github/workflows/Issue.Labeler.yml to label and assign issues on opened / edited.
• Adds .github/labeler.yml containing regex→label mappings for OS/Container/Area labels.

Show a summary per file

File	Description
.github/workflows/Issue.Labeler.yml	New workflow that runs labeler + owner auto-assignment on issue events.
.github/labeler.yml	New regex configuration mapping issue title/body matches to OS/Container/Area labels.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 4
• Review effort level: Low

[bbonaby]

issue: can we see if we can create teams and then assign items to the teams instead of single users. We can create a team for each backend, and then one for MXC core (which would be things for SDK functionality, infrastructure and non backend specific MXC things).