Stop writing the PR number into the size label artifact

[ChrisJBurns]

#6259 and #6260 have merged, so this is now a single commit against main and the blocker below no longer applies.

Summary

• Nothing reads pr-number.txt any more. Derive PR number from the triggering run in the size labeler #6259 changed the apply workflow to derive the pull request number from its own workflow_run event instead of from the artifact, because the artifact is produced by a pull_request workflow and is therefore attacker-influenced. This removes the now-unused write.
• It could not be done in Derive PR number from the triggering run in the size labeler #6259 itself. workflow_run consumers always execute the copy of the workflow on the default branch, never the version in the pull request. A pull request can change the producer — which does run from the pull request head — but cannot change the consumer reading its output until it merges. Dropping the write alongside the consumer change failed the apply job on every open pull request, because the producer stopped writing the file while main's consumer was still reading it.

So this is phase two of a two-phase rollout:

Phase	Change	Effect
#6259	Consumer stops reading pr-number.txt; producer keeps writing it	Old consumer on main still works throughout
This PR	Producer stops writing it	Safe once the new consumer is on main

CI state

#6259 is on main, so the consumer running against this pull request is the new one that ignores pr-number.txt. The apply job passes here — the ordering hazard described above is resolved, not merely tolerated.

Part of #6253

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)

• E2E tests (task test-e2e)

• Linting (task lint-fix)

• Manual testing (describe below)

• grep -rn "pr-number.txt" .github/ returns nothing across the whole directory, so producer and consumer agree.

• The workflow parses as YAML and actionlint is clean on it.

• The end-to-end behaviour was already proven on Derive PR number from the triggering run in the size labeler #6259: after the fix, its apply runs succeeded and both Derive PR number from the triggering run in the size labeler #6259 and Gate the Claude workflow on write access, not contribution history #6260 received size/XS through the new resolve-from-event path.

Does this introduce a user-facing change?

No.

Special notes for reviewers

• The artifact now carries a single file whose only permitted values are the five size/* labels, checked by the consumer. There is nothing left in it that can influence which pull request is acted on.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.71%. Comparing base (d163115) to head (8300561).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6261      +/-   ##
==========================================
- Coverage   72.71%   72.71%   -0.01%     
==========================================
  Files         742      742              
  Lines       77299    77299              
==========================================
- Hits        56209    56208       -1     
- Misses      17126    17127       +1     
  Partials     3964     3964              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.