ci: stop the .app header PR being closed as a new script

allowedBots carried "community-scripts-pr-app" but not the
"[bot]"-suffixed name GitHub actually reports, and the check is an exact
match, so the exemption never applied to it. push-app-to-main is listed
both ways; this one was not. PR #17304 was closed as an untested new
script submission because of it.

generate-app-headers.sh empties ct/headers, tools/headers and
vm/headers and writes them again, so every run reports those files as
added. That is what the autolabeler's new-script rule looks for, and
the vm rule matched vm/headers too. Exclude the header directories from
both, and skip them in the close workflow's own added-file fallback, so
the label cannot come back by another route.

Checked against minimatch with the shipped config: header files get
neither label, ct/*.sh, install/*.sh and vm/*.sh still get theirs.

.github/workflows/close-new-script-prs.yml

@@ -28,6 +28,7 @@ jobs:
             const allowedBots = [
               "push-app-to-main[bot]",
               "push-app-to-main",
+              "community-scripts-pr-app[bot]",
               "community-scripts-pr-app"
             ];
 
@@ -62,7 +63,9 @@ jobs:
                 per_page: 100,
               });
               hasAddedScriptFile = files.some(
-                f => f.status === "added" && scriptPrefixes.some(p => f.filename.startsWith(p))
+                f => f.status === "added" &&
+                     !f.filename.includes("/headers/") &&
+                     scriptPrefixes.some(p => f.filename.startsWith(p))
               );
             } catch (error) {
               core.warning(`Could not list files for PR #${prNumber}: ${error.message}`);