ci: add do-not-merge label check workflow - #19292

Please address the comments from this code review:

## Overall Comments
- The LABELS check relies on `grep` against the JSON-encoded label list, which is a bit brittle; consider using a workflow-level conditional like `if: contains(join(github.event.pull_request.labels.*.name, ','), 'do-not-merge')` or parsing via `jq` for a more robust and readable check.
- If you expect labels with different casing or variants (e.g. `Do Not Merge`), you may want to either normalize label names to lowercase before checking or support a small set of allowed label strings to avoid false negatives.

## Individual Comments

### Comment 1
<location path=".github/workflows/do-not-merge.yaml" line_range="11-15" />
<code_context>
+  do-not-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Block merge if do-not-merge label is present
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          if echo "$LABELS" | grep -q 'do-not-merge'; then
+            echo "::error::PR has the 'do-not-merge' label. Remove it before merging."
+            exit 1
</code_context>
<issue_to_address>
**suggestion:** Consider using a native GitHub Actions `if:` condition instead of a shell `grep` to check for the label.

You can express this entirely in the workflow using GitHub’s expression syntax, avoiding the extra shell step and JSON handling:

```yaml
jobs:
  do-not-merge:
    runs-on: ubuntu-latest
    if: ${{ contains(github.event.pull_request.labels.*.name, 'do-not-merge') }}
    steps:
      - run: |
          echo "::error::PR has the 'do-not-merge' label. Remove it before merging."
          exit 1
```

This keeps the check declarative and makes the condition visible in the workflow UI instead of buried in a script.
</issue_to_address>