ci: persist fork approval labels across pushes (#2924)

.github/scripts/preview-env-workflow-contract_test.py

@@ -31,6 +31,18 @@ class PreviewEnvironmentWorkflowContractTest(unittest.TestCase):
             deploy_job,
         )
 
+    def test_safe_to_test_approval_survives_follow_up_pushes(self) -> None:
+        workflow = WORKFLOW.read_text(encoding="utf-8")
+        _, separator, deploy_job = workflow.partition("  deploy-fork:")
+
+        self.assertTrue(separator, "Fork preview deploy job is missing")
+        self.assertIn(
+            "((contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||",
+            deploy_job,
+        )
+        self.assertNotIn("  strip-safe-to-test:", workflow)
+        self.assertNotIn("github.rest.issues.removeLabel", workflow)
+
 
 if __name__ == "__main__":
     unittest.main()