chore(labels): add dry-run label audit script

[ss-o]

Summary

• add a read-only scripts/labels-dry-run.rb audit script that consumes lib/labels.yml
• report missing, mismatched, legacy, and unknown labels without applying changes
• document the dry-run step and usage examples in runbooks/labels.md

Validation

• ruby -c scripts/labels-dry-run.rb
• scripts/labels-dry-run.rb --repo z-shell/.github --include-clean
• scripts/labels-dry-run.rb --repo z-shell/zi
• JSON smoke test against z-shell/.github

Notes

• This does not create, update, migrate, or delete any labels.
• This does not comment on issues or change issue/PR labels.
• Unknown local labels are preserved for manual review by design.

Refs #411

[Copilot]

Pull request overview

Adds a read-only audit tool to compare the canonical org label set (lib/labels.yml) against live GitHub repos, plus runbook guidance to run the audit before doing any label cleanup/sync work.

Changes:

• Introduces scripts/labels-dry-run.rb to report missing, mismatched, legacy, and unknown labels without applying mutations.
• Extends runbooks/labels.md with a “dry-run first” step and usage examples for Markdown/JSON output.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
scripts/labels-dry-run.rb	New Ruby CLI that queries labels via gh and diffs them against lib/labels.yml, outputting Markdown or JSON.
runbooks/labels.md	Documents the new dry-run workflow and provides invocation examples.

[ss-o]

@copilot check if conversations resolved

[Copilot]

@copilot check if conversations resolved

Yes, all four threads are resolved in c0ec437:

• YAML.safe_load — fixed with permitted_classes: [], permitted_symbols: [], aliases: false + structure validation
• --all-repos + --repo conflict — errors out when both flags are supplied
• Angle-bracket placeholder — runbook now uses z-shell/REPO
• Paginated JSON — replaced with gh_paginated_array using --template to emit one object per line