fix(python/robomp): corrected issue classification updates on rename-fail

- Moved issue classification updates to run only after branch rename succeeds, preventing partial labeling or DB writes when rename fails.
- Adjusted workspace ownership normalization to chown workspaces to the active slot or, when slotless, to the current euid/egid, then apply shared permissions.
- Added tests for classify_issue rename-failure rollback and chown_workspace normalization in non-slot mode.

python/robomp/src/host_tools.py

@@ -1093,20 +1093,6 @@ def _build_classify_issue(bindings: ToolBindings) -> HostTool[Any, Any]:
             labels.append(platform)
         labels.append("triaged")
 
-        try:
-            applied = _run_coro(
-                bindings.loop,
-                bindings.github.add_issue_labels(
-                    bindings.repo.full_name,
-                    bindings.issue.number,
-                    labels,
-                ),
-            )
-        except GitHubError as exc:
-            _audit(bindings, "classify_issue", args, error=str(exc))
-            _raise_command(f"GitHub rejected labels: {exc.status} {exc.message}")
-
-        bindings.db.set_issue_classification(bindings.issue_key, primary)
         renamed_to: str | None = None
         if branch_slug:
             try:
@@ -1128,6 +1114,21 @@ def _build_classify_issue(bindings: ToolBindings) -> HostTool[Any, Any]:
                 # refactor of that helper still surfaces the mismatch.
                 _raise_command("classify_issue internal: branch rename inconsistent.")
             bindings.db.set_issue_branch(bindings.issue_key, renamed_to)
+
+        try:
+            applied = _run_coro(
+                bindings.loop,
+                bindings.github.add_issue_labels(
+                    bindings.repo.full_name,
+                    bindings.issue.number,
+                    labels,
+                ),
+            )
+        except GitHubError as exc:
+            _audit(bindings, "classify_issue", args, error=str(exc))
+            _raise_command(f"GitHub rejected labels: {exc.status} {exc.message}")
+
+        bindings.db.set_issue_classification(bindings.issue_key, primary)
         _audit(
             bindings,
             "classify_issue",