feat(workflow): define four-axis label contract

[purp]

Summary

Define the four-axis workflow label contract and a repeatable provisioning path for the accepted workflow labeling epic.

Related Issue

Closes #3810
Part of #3807

Changes

• Add the canonical label manifest for type, state, needs, and ready-for.
• Add an idempotent label provisioning command with dry-run as the default.
• Document the issue workflow and link it from contributor docs navigation.

Testing

• mise run pre-commit passes
• Unit tests added/updated for label validation and provisioning
• E2E tests added/updated (not applicable)
• mise run ci passes with an isolated Go lint cache

Checklist

• Follows Conventional Commits
• Commits are signed and signed off (DCO)
• Architecture docs updated (not applicable; contributor workflow docs updated)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3820.docs.buildwithfern.com/openshell

[purp]

/ok to test 01fe056