feat: reduce label 'other' with honest non-protocol labels

Most 'other' rows with a diff were CI/build/test/CLI/metrics changes, not
protocol areas. Added build-ci / cli / metrics-observability / test labels
(path/keyword rules + LLM vocab) so those are labelled accurately rather than
forced into a protocol area. 'other' 251 -> 147 (11.3% -> 6.6%); label coverage
88.7% -> 93.4% (build-ci 103, test 66, cli 42, metrics 21). The remaining
'other' are genuinely generic (event/backend orchestration, advisory-no-diff,
vendored). docs/label_design.md + BUILD_REPORT updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: grandchildrice

data/ethereum_vulns.csv

@@ -90,7 +90,7 @@
       "1.0": 167
     },
     "residual_boilerplate_fp": 0,
-    "labelled": 2078,
+    "labelled": 2184,
     "deduped_fix_commit": 108
   },
   "source": "11 Ethereum execution + consensus clients (past security fixes)"

data/ethereum_vulns.parquet

@@ -81,7 +81,7 @@ Critical** (geth, besu, teku). Severities preserved through the canonical path.
 | column | coverage | notes |
 |---|---:|---|
 | `source_url`, `title`, `description`, `attack_path` | 100.0% | attack_path defaults to a best-effort class |
-| `label` (assigned, non-`other`) | **88.4%** | deterministic path/keyword + LLM fallback (`gemma4:31b`) reading the diff or, for no-commit rows, the advisory text |
+| `label` (assigned, non-`other`) | **93.4%** | deterministic path/keyword + LLM fallback (`gemma4:31b`) reading the diff or, for no-commit rows, the advisory text |
 | `root_cause` (assigned) | 86.8% | keyword + classifier reason + LLM |
 | `cwe_top25` (from advisory/diff text via LLM) | **24.7%** | read from the link's advisory text / diff even when no fix commit exists — advisories often lack a CWE but the Impact text yields one |
 | `fix_commit` / `introduced_in_commit` | **88.0%** | `/commit/` + `/pull/` URLs, GHSA advisory patch-releases, and **inline `#PR` / commit refs parsed from CHANGELOG/release text** (author-linked, high precision) |

data/ethereum_vulns.preview.csv

@@ -85,7 +85,14 @@ pyspec `process_*` operations:
 
 ### Cross-cutting (either layer)
 `crypto` (hashing, secp256k1, BLS/KZG math) · `serialization` (SSZ / RLP not tied
-to one area) · `database` (storage / DB layer) · `other` (keep rare; forces review).
+to one area) · `database` (storage / DB layer) · `build-ci` (build system, CI,
+Docker, dependency manifests, vendored deps) · `cli` (command-line / node startup
+/ flags) · `metrics-observability` (metrics, diagnostics, tracing, logging) ·
+`test` (test-only changes) · `other` (keep rare; forces review).
+
+The non-protocol labels (`build-ci` / `cli` / `metrics-observability` / `test`)
+exist so a CI/build/test/CLI change is labelled *accurately* rather than forced
+into a protocol area — they keep the `other` bucket small and honest.
 
 ---
 

data/labels.csv

@@ -176,10 +176,17 @@ def resolve_advisory(client, ghsa, summary):
     (r"devp2p|/p2p|discover|/eth/protocol|/eth/handler|snap[-_]?protocol|wire", "p2p"),
     (r"block[-_]?process|/core/blockchain|verifyheader|process(?:block|_block)|state_transition", "block-processing"),
 ]
-_X = [  # cross-cutting (checked last)
+_X = [  # cross-cutting (checked after protocol rules; most-informative first)
     (r"crypto|secp256|ecrecover|keccak|\bhash\b|blst|bn256|bls12|schnorr", "crypto"),
     (r"\bssz\b|serial|encode|decode|marshal|unmarshal|codec", "serialization"),
     (r"leveldb|rocksdb|pebble|/db\b|database|/ethdb|/storage/kv", "database"),
+    # non-protocol but real areas (keeps 'other' honest instead of forced)
+    (r"\.github|\.circleci|dockerfile|docker-compose|\.gradle\b|gradle/|makefile\b"
+     r"|/build/|verification-metadata|renovate|/vendor/|docs/vulnerab|go\.mod\b|go\.sum"
+     r"|package-lock|yarn\.lock|Cargo\.(?:toml|lock)|\.ya?ml\b", "build-ci"),
+    (r"metric|diagnostic|prometheus|grafana|observ|telemetr|tracing|\botel\b", "metrics-observability"),
+    (r"\bcmd/|/cli/|main\.(?:go|rs)\b|BesuCommand|/flags?/|command\.java", "cli"),
+    (r"_test\.(?:go|rs|py|ts|js)|/tests?/|testhelper|mock_|spec\.(?:ts|js)|\bfuzz", "test"),
 ]
 _C = [(re.compile(p, re.I), l) for p, l in _C]
 _E = [(re.compile(p, re.I), l) for p, l in _E]
@@ -299,7 +306,8 @@ def _group(hunks):
     "evm", "opcodes", "precompiles", "gas", "transactions", "txpool",
     "block-processing", "state-trie", "rlp", "p2p", "sync", "engine-api",
     "blobs", "eof", "rpc"]
-CROSS = ["crypto", "serialization", "database", "other"]
+CROSS = ["crypto", "serialization", "database", "build-ci", "cli",
+         "metrics-observability", "test", "other"]
 RC_ENUM = [v for _, v in _RC] + ["improper_state_update", "other"]
 AP_ENUM = [v for _, v in _AP] + ["internal_only"]