chore(labels): adopt org reusable label-sync (#29)

* chore(labels): adopt org reusable label-sync

* chore(labels): set top-level permissions, re-pin reusable to fixed SHA

Adds a top-level permissions: {} (least-privilege default, clears Checkov
CKV2_GHA_1) and re-pins reusable-label-sync to the fixed org SHA
08f06af (JSON merge output; prevents hex-color coercion). Rewords the
header comment so each parenthetical closes on its own line.

Author: zircote

.github/workflows/label-sync.yml

@@ -0,0 +1,20 @@
+# Sync this repo's labels to the org standard in modeled-information-format/.github
+# (the labels.yml source of truth), plus an optional repo-local overlay
+# (.github/labels.yml).
+name: Sync labels
+on:
+  push:
+    branches: [main]
+    paths: ['.github/labels.yml', '.github/workflows/label-sync.yml']
+  schedule:
+    - cron: '0 6 * * 1'   # weekly drift correction
+  workflow_dispatch: {}
+permissions: {}
+jobs:
+  labels:
+    permissions:
+      contents: read
+      issues: write
+    uses: modeled-information-format/.github/.github/workflows/reusable-label-sync.yml@08f06af29dfb1877e2dcfaaa90bf773a63261139
+    with:
+      local-labels: .github/labels.yml   # merged over the org set; absent file = org set only