fix: address review findings on forensics PR #1305

1. Resolve read-only contradiction: critical_rules now explicitly allows
   STATE.md session tracking alongside the forensic report write
2. Add label existence check before gh issue create --label "bug" to
   handle repos without a "bug" label gracefully

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

commands/gsd/forensics.md

@@ -49,7 +49,7 @@ Read and execute the forensics workflow from @~/.claude/get-shit-done/workflows/
 </success_criteria>
 
 <critical_rules>
-- **Read-only investigation:** Do not modify any project files during forensics. Only write the report.
+- **Read-only investigation:** Do not modify project source files during forensics. Only write the forensic report and update STATE.md session tracking.
 - **Redact sensitive data:** Strip absolute paths, API keys, tokens from reports and issues.
 - **Ground findings in evidence:** Every anomaly must cite specific commits, files, or state data.
 - **No speculation without evidence:** If data is insufficient, say so — do not fabricate root causes.

get-shit-done/workflows/forensics.md

@@ -243,9 +243,16 @@ If actionable anomalies were found (HIGH or MEDIUM confidence):
 
 If confirmed:
 ```bash
+# Check if "bug" label exists before using it
+BUG_LABEL=$(gh label list --search "bug" --json name -q '.[0].name' 2>/dev/null)
+LABEL_FLAG=""
+if [ -n "$BUG_LABEL" ]; then
+  LABEL_FLAG="--label bug"
+fi
+
 gh issue create \
   --title "bug: {concise description from anomaly}" \
-  --label "bug" \
+  $LABEL_FLAG \
   --body "{formatted findings from report}"
 ```