Protect airflow-ctl/v0-1-stable and wire up backport label (#65610)

Add airflow-ctl/v0-1-stable to .asf.yaml protected_branches so merges
require a reviewed PR and linear history, matching how core vX-Y-stable
branches are protected. The companion airflow-ctl/v0-1-test branch is
intentionally left unprotected so the release manager can push
cherry-picks and sync-PR merge commits onto it directly.

Wire backport-to-airflow-ctl-v0-1-test into boring-cyborg.yml on PRs
touching airflow-ctl/**/* that target main, so the release manager
sees at a glance which PRs might need to be backported to the 0.1
maintenance branch.

The matching GitHub label backport-to-airflow-ctl-v0-1-test is created
out-of-band via `gh label create`.

Author: potiuk

.asf.yaml

@@ -162,6 +162,11 @@ github:
       required_linear_history: true
       required_conversation_resolution: true
       required_signatures: false
+    airflow-ctl/v0-1-stable:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+      required_linear_history: true
+      required_signatures: false
   collaborators:
     # Max 10 collaborators allowed
     # https://github.com/apache/infrastructure-asfyaml/blob/main/README.md#assigning-the-github-triage-role-to-external-collaborators

.github/boring-cyborg.yml

@@ -365,6 +365,15 @@ labelPRBasedOnFilePath:
     targetBranchFilter:
       - ^main$
 
+  # Apply to PRs touching airflow-ctl code so the release manager notices when a
+  # fix should land on the airflow-ctl/v0-1-test maintenance branch.
+  # Scoped to PRs targeting `main` only.
+  backport-to-airflow-ctl-v0-1-test:
+    paths:
+      - airflow-ctl/**/*
+    targetBranchFilter:
+      - ^main$
+
   kind:documentation:
     - airflow-core/docs/**/*
     - chart/docs/**/*