chore: add org label sync workflow

[beatrizmcouto]

Summary

• Adds a manual Labels: Sync workflow to reconcile labels across complytime repositories
• Adds labels-policy.json to define standard labels, rename-only migrations, local-only labels to preserve, and labels to delete
• Adds scripts/sync_labels.py to apply the policy repo by repo
• Documents the new workflow in README.md and MAINTAINING.md

Behavior

The workflow targets all complytime repositories except complytime/complytime and roadmap.

It supports three behaviors at once:

• Create everywhere for the shared standard labels
• Rename only where already present for labels like 60 days, clean up, docker, llm_assisted, question, to validate, and to validade
• Leave local-only labels untouched for labels that should remain repo-specific and should not be replicated

Assumptions

• private-sprint-sub-issue is treated as preserve, not delete, because it appeared in the keep-list and the existing live label uses that casing
• docker is renamed to container
• question, to validate, and to validade are consolidated into validate

Related Issues

N/A

Review Hints

• Review labels-policy.json first; it is the source of truth for the requested label changes
• The workflow is manual (workflow_dispatch) so it can be dry-run safely before any org-wide apply
• This PR does not apply the changes yet; it adds the tooling to do so after merge

---

Generated with Cursor assistance

[marcusburghardt]

@beatrizmcouto , this implementation would fit better in org-infra repository. But I was quickly checking and we can manage all these organization labels at once for all repositories: https://docs.github.com/en/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization

In this case a script would not be necessary at all. For the renames we do it ad-hoc. WDYT?

[gxmiranda]

@marcusburghardt your suggestion of using the GitHub native solution for label management inside an Org sounds good. However, as we currently handle 3 orgs simultaneously (CT, UF, ASDLC), this approach wouldn't be enough to cover label mgmt across all of them, as it only allows labels to be synced inside the same org.
My suggestion is that we go with @beatrizmcouto approach, but moving the PR to the org-infra as suggested by @marcusburghardt , as it is indeed a better fit for this kind of workflow.
Having that in mind, we need to ensure that org-infra also handles UF and ASDLC configs and workflows, and as agreed with @jflowers this is a natural step moving forward, so I will PoC the org-infra sync with UF and ASDLC as a follow up action.