chore: add org label sync workflow

[beatrizmcouto]

Summary

• Adds a manual Labels: Sync workflow to reconcile labels across complytime repositories
• Adds labels-policy.json to define standard labels, rename-only migrations, local-only labels to preserve, and labels to delete
• Adds scripts/sync_labels.py to apply the policy repo by repo
• Documents the new workflow in README.md and MAINTAINING.md

Behavior

The workflow targets all complytime repositories except complytime/complytime and roadmap.

It supports three behaviors at once:

• Create everywhere for the shared standard labels
• Rename only where already present for labels like 60 days, clean up, docker, llm_assisted, question, to validate, and to validade
• Leave local-only labels untouched for labels that should remain repo-specific and should not be replicated

Assumptions

• private-sprint-sub-issue is treated as preserve, not delete, because it appeared in the keep-list and the existing live label uses that casing
• docker is renamed to container
• question, to validate, and to validade are consolidated into validate

Related Issues

N/A

Review Hints

• Review labels-policy.json first; it is the source of truth for the requested label changes
• The workflow is manual (workflow_dispatch) so it can be dry-run safely before any org-wide apply
• This PR does not apply the changes yet; it adds the tooling to do so after merge

---

Generated with Cursor assistance