ci: run the labels-sync test suite in CI

[ss-o]

The scripts/test-labels-dry-run.sh suite is not executed by any workflow. Nothing in .github/workflows/ runs scripts/, so the suite only runs when someone remembers to invoke it manually.

That suite is not decorative. During #466 it caught two real defects in new code:

• an in-use legacy label being queued for deletion
• a migration deleting the legacy label before relabelling the items that carried it

Both would have destroyed label associations across the organization. A third defect — a race between planning and deletion — was found in review and is now covered by the suite as well.

Leaving it unwired repeats the pattern #464 documented: a control that exists in the repository but not in reality.

Proposal

Add a workflow that runs the suite on pushes and pull requests touching scripts/labels-sync.rb, scripts/labels-dry-run.rb, scripts/test-labels-dry-run.sh, or lib/labels.yml.

The suite makes read-only preview calls against this repository, so the job needs contents: read and issues: read plus GH_TOKEN. It never passes a --confirm-* flag, and the script refuses every destructive path without one.

Acceptance criteria

• Workflow runs the suite on changes to the label tooling
• Job fails when the suite fails (verified against a deliberately broken script)
• Follows org workflow conventions: SHA-pinned actions, least-privilege permissions:, concurrency:, kebab-case filename, no emoji in name: