Summary

Add a temporary dependency-guard-backfill label trigger to the Dependency Guard workflow so maintainers can backfill the required dependency-guard check on old open PR heads without requiring contributors to push, rebase, close/reopen, or rerun the rest of CI.

• Adds labeled to the pull_request_target activity types.
• Gates labeled events to only run for dependency-guard-backfill.
• Keeps normal opened/reopened/synchronize/ready_for_review behavior unchanged.

Backfill Plan

This is the first step in a temporary three-PR backfill flow:

1. This PR teaches Dependency Guard to run when maintainers add dependency-guard-backfill.
2. ci: isolate dependency guard backfill label #87882 prevents broad label-triggered workflows from reacting to that label, so the batch labeler only wakes Dependency Guard and does not fan out unrelated automation.
3. Maintainers run the attached local batch script against the frozen audit set of old PRs that already have a real failing non-dependency check or a local merge conflict, then chore: revert dependency guard backfill machinery #87867 removes the temporary trigger once the backfill window is complete.

The script/artifact bundle is attached in this PR's comments as a secret gist. It is resumable, dry-run by default, and applies the label in batches using local gh auth unless GH_TOKEN is set.

Verification

• Parsed .github/workflows/dependency-guard.yml with yaml and confirmed the trigger and job condition.
• git diff --check -- .github/workflows/dependency-guard.yml test/scripts/dependency-guard-workflow.test.ts