Adds the org standard callable-labeler thin caller, missing on this repo (present on 26/28 repos; another symptom of the skipped provisioning checklist). All three permission grants are load-bearing; omitting one causes a silent startup_failure.
