build: read live PR labels in check-label action

### .github/actions/check-label/action.yml
@@ -20,11 +20,36 @@ runs:
     - name: Check for label
       id: check
       shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        LABEL: ${{ inputs.label }}
+        SKIP_MESSAGE: ${{ inputs.skip-message }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        # Labels as seen in the event payload. This is a snapshot taken when
+        # the workflow was triggered and is only used as a fallback.
+        EVENT_LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
       run: |
-        if [[ "${{ contains(github.event.pull_request.labels.*.name, inputs.label) }}" == "true" ]]; then
-          echo "::notice::${{ inputs.skip-message }}"
-          echo "${{ inputs.skip-message }}" >> $GITHUB_STEP_SUMMARY
-          echo "skip=true" >> $GITHUB_OUTPUT
+        # The event payload only reflects the labels that were present when
+        # the workflow was triggered. A label added afterwards (e.g. to
+        # auto-pass a check on an already running or re-run job) would never
+        # be seen. Query the API for the current label set instead so that
+        # re-running a job picks up labels added after the run kicked off.
+        labels="${EVENT_LABELS:-[]}"
+        if [[ -n "$PR_NUMBER" ]]; then
+          if live=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/labels?per_page=100" \
+            --jq '[.[].name]'); then
+            labels="$live"
+          else
+            echo "::warning::Failed to fetch live labels for PR #${PR_NUMBER}, falling back to the event payload"
+          fi
+        fi
+
+        echo "Labels on PR #${PR_NUMBER:-<none>}: ${labels}"
+
+        if jq -e --arg l "$LABEL" 'index($l) != null' <<< "$labels" >/dev/null; then
+          echo "::notice::${SKIP_MESSAGE}"
+          echo "${SKIP_MESSAGE}" >> "$GITHUB_STEP_SUMMARY"
+          echo "skip=true" >> "$GITHUB_OUTPUT"
         else
-          echo "skip=false" >> $GITHUB_OUTPUT
-        fi
\ No newline at end of file
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi

### .github/workflows/main.yml
@@ -16,6 +16,8 @@ permissions:
   actions: write
   # Default permission for checking out code.
   contents: read
+  # Required to read the current PR labels via the API in check-label.
+  pull-requests: read
 
 concurrency:
   # Cancel any previous workflows if they are from a PR or push.