Replace unmaintained labels CLI with a stdlib label sync script

[matagus]

The "Sync Github labels" workflow has been failing since GitHub made label archiving GA (2026-08-27). Every label object in the REST API now carries archived_at and archived_by, and the labels package (hackebrot/labels) deserialises responses into a strict frozen attrs class:

TypeError: Label.__init__() got an unexpected keyword argument 'archived_at'

That package last shipped in May 2020 and the upstream issue for this exact error is still open with no response, so pinning cannot help. GitHub also adds fields over time, so the replacement reads only the fields it manages and ignores everything else.

• add .github/sync_labels.py: stdlib only (tomllib + urllib), no pip install needed; keeps .github/labels.toml as the source of truth and reproduces labels sync semantics (create missing, update drifted, delete extras), plus --dry-run, --no-delete, config validation and real exit codes
• run it from the workflow and scope permissions explicitly (contents: read, issues: write) instead of relying on the repo default
• compare colours case-insensitively: the old CLI diffed "687DEA" against GitHub's normalised "687dea" and re-PATCHed those labels on every run
• rename the github-actions label to Dependabot's own github_actions, so the sync stops deleting the label Dependabot recreates on every bump

The remote dry-run against matagus/quickup reports: github_actions recoloured 000000 -> 595e8a, the unused hyphen variant deleted, 28 labels unchanged.