The changelog check decided whether a PR was exempt using the labels in
the triggering event payload (github.event.pull_request.labels). That
payload is frozen at event time, so a PR that gets the
kind/changelog-not-required label after its first run could not pass by
re-running the failed job, and the exemption only took effect if a brand
new event happened to fire afterward.
Move the exemption logic into hack/changelog-check.sh and query the PR's
current labels via the GitHub API instead. Re-runs and labels added after
the initial run are now evaluated correctly. The workflow grants
pull-requests: read and passes github.token so the script can read labels.
The exempt label set (kind/changelog-not-required, Design, Website,
Documentation) is unchanged.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>