Dedupe the openspec --list safe-capture idiom across three workflows #289

Three workflows carry a near-verbatim copy of the safe-capture idiom for node .github/scripts/openspec-tracking.cjs --list, along with a copy of the explanatory comment recording why stderr goes to a file rather than into the captured value:

• .github/workflows/openspec-label.yml
• .github/workflows/openspec-sweep.yml
• .github/workflows/openspec-tracking.yml

Raised in review on #285 (#285 (comment)). Not a bug: all three are correct today. The cost is that a future change to the capture strategy has to be applied and hand-verified three times, and a partial edit leaves one workflow on the old behavior with nothing reporting it.

What would not fix it: moving the listing inside a child_process call in openspec-tracking.cjs. The workflow still has to run node and capture that outer process's stdout, and the outer capture is where the 2>&1 defect lived.

What would: a composite action under .github/actions/, owning the 2>"$file" capture and exposing changes, ok, and error as outputs. Each workflow keeps its own failure response, which is genuinely different in each: openspec-label.yml leaves the label alone and writes an OpenSpec: unknown summary, while the other two set skipped=true and exit zero.

Constraint on any fix here: none of these three workflows may ever fail a check. They report through a label, a job summary, or an issue. A composite action would be the first in this repo and is not covered by openspec-tracking.test.cjs, so it needs a deliberate rollout rather than being folded into an unrelated fix.