feat(labels): package safe repository automation

[szmyty]

Closes #3.

Outcome

Packages Relay as the execution layer for the canonical organization label contract owned by egohygiene/.github.

• lock the exact merged ORG-01 catalog and repository assignments by commit and SHA-256
• plan and separately apply canonical label synchronization
• preserve unmanaged labels and require both explicit retirement and apply authority for deletion
• package an organization-v1 shared path profile with repository additions and same-label overrides
• add deterministic path and size labels, first-contributor welcome, and fork maintainer-edit policy
• support absent configuration and configurable missing-label error/warn adoption
• expose four least-privilege reusable workflows and one composite action
• document thin consumer workflows, rollback, security, and configuration

Pull-request trust boundary

The pull-request planner has read-only permissions, checks out only the trusted base SHA, and never executes contributor code. The write-capable workflow_run handoff:

1. verifies workflow, event, conclusion, repository, run ID, and candidate checksum;
2. confirms the candidate PR is uniquely associated with the triggering run;
3. re-fetches live provider metadata;
4. checks out only the live base SHA and the immutable organization contract;
5. independently recomputes the complete plan;
6. requires exact checksum agreement before applying managed metadata.

No workflow uses pull_request_target.

Validation

• python3 scripts/validate_actions.py
• python3 -m unittest discover -s tests -v — 193 passed
• python3 -m compileall -q actions scripts tests
• all JSON and workflow YAML parsed locally
• git diff --check

The remote commit tree SHA was verified byte-for-byte against the local committed tree before PR creation.