Duplicate labels Keys in .woodpecker.yml
Routing Woodpecker pipelines to the infra-vps agent is a one-line contract: `labels.location: infra-vps` at the top of `.woodpecker.yml`. Commit ecdde91 removed a second `labels:` key that YAML had been using to overwrite the first. The agent affinity was in the file. The parser kept the last copy.
That is not a Woodpecker quirk. It is how YAML mappings work. Duplicate keys are invalid in the spec and silently last-wins in most Go and Python loaders. On a dual-VPS layout, last-wins means the job might schedule on the Forgejo box again and OOM the security lane.
The pipeline header is short on purpose: `when` for push, pull_request, and the `portfolio-writing-poll` cron, then a single `labels` map. `location: infra-vps` is the affinity the Woodpecker agent on the infra VPS advertises.