fix: repair architecture-submission.yml so the architecture-ready label actually triggers it

[mrbobbytables]

Root cause

jobs.import.if in architecture-submission.yml read:

if: github.event.label.name == env.SUBMISSION_LABEL

The env context is not available in a job-level if: — it's only
populated once a job's steps start running (see context
availability:
jobs.<job_id>.if only exposes github, inputs, needs, and vars).
GitHub doesn't error on this; it just never lets the condition evaluate
truthy, so the import job silently never ran, for any issues: labeled event on any label, since the workflow was added in #805.

This is exactly what happened on #813: applying the architecture-ready
label produced no workflow run at all (confirmed via gh api repos/cncf/endusers/actions/workflows/369493783/runs, which shows zero
event: issues runs, ever). actionlint catches this immediately:

architecture-submission.yml:23:36: context "env" is not allowed here.
available contexts are "github", "inputs", "needs", "vars"

Fix

• Inline the label literal in the if: condition instead of referencing
  env.SUBMISSION_LABEL (which stays as-is for the steps that already
  reference it, where env is valid).
• Add a regression test (tests/workflow-scripts.test.mjs) that fails if
  any workflow's job-level if: references the env context again.
  Verified it fails against the pre-fix workflow and passes after.

Testing

• npx actionlint .github/workflows/*.yml - clean.
• npm run test:unit - 1421 passed, 0 failed.
• Manually confirmed the new test fails against the unfixed workflow and
  passes against the fix.

Fixes #813