fix(labeler): cover monorepo layouts and harden the reusable workflow

The central label rules assumed a root-level project layout
(lib/**, bin/**, cdk/**, src/**), so monorepos that nest components
under top-level dirs (infra/, web/, mobile/, shared/) matched nothing
for those areas. PRs touching only infra/lib/** or web/** ran the
labeler green but received no label.

Label coverage:
- infra: + 'infra/**' (covers infra/lib, infra/bin, infra/cdk.json)
- app:   + 'web/**', 'mobile/**', 'shared/**'
Additions are appended to the existing root paths, so single-project
repos are unaffected; deliberately avoided blanket '**/lib/**' globs
that would mislabel web/src/lib/** as infra.

Hardening rolled in while here:
- Pin actions/labeler to a commit SHA (was the floating @v6 tag)
- Add a per-PR concurrency group with a run_id fallback for non-PR
  callers, so rapid pushes cancel superseded label runs
- Broaden 'ci' (.github/actions/**), 'dependencies'
  (Directory.Packages.props, yarn.lock, pnpm-lock.yaml, Podfile/.lock)
  and 'tests' (JS/TS .test/.spec, pytest test_*.py/conftest,
  .NET *Tests.cs, Java *Test.java, Go, Ruby) globs

Caller repos must already have any label a rule can emit; actions/labeler
does not create missing labels. The org 'infra' label was backfilled
across repos separately.

.github/workflows/callable-labeler.yaml

@@ -29,6 +29,10 @@ permissions:
   pull-requests: write
   issues: write
 
+concurrency:
+  group: labeler-${{ github.event.pull_request.number || github.run_id}}
+  cancel-in-progress: true
+
 jobs:
   label:
     runs-on: ubuntu-latest
@@ -48,6 +52,7 @@ jobs:
                     - 'template.yml'
                     - '**/template.yaml'
                     - 'samconfig.toml'
+                    - 'infra/**'
           app:
             - changed-files:
                 - any-glob-to-any-file:
@@ -56,6 +61,9 @@ jobs:
                     - 'lambdas/**'
                     - 'api/**'
                     - 'services/**'
+                    - 'web/**'
+                    - 'mobile/**'
+                    - 'shared/**'
           content:
             - changed-files:
                 - any-glob-to-any-file:
@@ -68,6 +76,7 @@ jobs:
             - changed-files:
                 - any-glob-to-any-file:
                     - '.github/workflows/**'
+                    - '.github/actions/**'
           docs:
             - changed-files:
                 - any-glob-to-any-file:
@@ -80,16 +89,48 @@ jobs:
                     - '**/package-lock.json'
                     - '**/*.csproj'
                     - '**/packages.lock.json'
+                    - '**/Directory.Packages.props'
+                    - '**/yarn.lock'
+                    - '**/pnpm-lock.yaml'
+                    - '**/Podfile'
+                    - '**/Podfile.lock'
                     - '.github/dependabot.yml'
           tests:
             - changed-files:
                 - any-glob-to-any-file:
+                    # directory conventions (covers Java src/test, Ruby test/spec, etc.)
                     - '**/tests/**'
                     - '**/test/**'
+                    - '**/spec/**'
+                    - '**/__tests__/**'
+                    # JS / TS
+                    - '**/*.test.js'
+                    - '**/*.test.jsx'
                     - '**/*.test.ts'
+                    - '**/*.test.tsx'
+                    - '**/*.spec.js'
+                    - '**/*.spec.jsx'
+                    - '**/*.spec.ts'
+                    - '**/*.spec.tsx'
+                    # Python
                     - '**/*_test.py'
+                    - '**/test_*.py'
+                    - '**/conftest.py'
+                    # .NET
+                    - '**/*Tests.cs'
+                    - '**/*Test.cs'
+                    - '**/*.Tests/**'
+                    # Java / JVM
+                    - '**/*Test.java'
+                    - '**/*Tests.java'
+                    - '**/*IT.java'
+                    # Go
+                    - '**/*_test.go'
+                    # Ruby
+                    - '**/*_spec.rb'
+                    - '**/*_test.rb'
           EOF
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213  # v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: ${{ runner.temp }}/labeler.yml