closeout: gate-label audit + seed ci:full / auto-triaged / doc-orphan

[ArchonVII]

Part of the PR-closeout contract repair (session 019eccc1, F1).

GW-B — labels in github-workflows:

• A gate that references a GitHub label which was never seeded fails on repos that lack it (gh ... --label X errors; label-gated jobs misfire). The closeout session hit this with no-changelog.
• Add a gate-label audit (scripts/gate-labels.mjs + test): statically collect every label declared as a *-label / *-labels workflow-input default, and fail if any is not in the seed set. Unreferenced seed labels are reported as informational only (many are valid manual/triage labels).
• The audit immediately surfaced three referenced-but-unseeded labels — ci:full (repo-required-gate force-full-ci-label), auto-triaged (anomaly-triage), doc-orphan (doc-orphan-detector) — now added to the seed.
• The seed array was moved to scripts/labels.mjs so the audit can import it without executing the setup-repo.mjs CLI.

Provisioning of the live repos with the full label set (so our own repos stop lacking no-changelog/ci:full) is a separate step run with setup-repo.mjs.

[ArchonVII]

Delivered. Verified firsthand on main @ 85cf6fa (2026-07-01):

• Gate-label audit + seed of the three referenced-but-unseeded labels (ci:full, auto-triaged, doc-orphan): landed in 32e057d (PR feat(labels): add gate-label audit and seed referenced-but-unseeded labels #84); seed moved to scripts/labels.mjs; scripts/gate-labels.mjs + scripts/gate-labels.test.mjs present. Common-default labels added in 3129c15 (PR feat(labels): add common-default labels to canonical seed #88).
• Suite re-run: npm test → vitest 9 files / 159 tests / 159 pass.

The one remaining item the issue itself scoped out — provisioning the live repos with the full seed via setup-repo.mjs — is folded into the consumer backfill pass of the 2026-07-01 friction arc (runs with the other per-repo changes so each consumer gets one visit, not several).