ci: validate governance sources and label-sync targets

[DerekCorniello]

Issue 29 follow-up. Add credential-free governance source validation and reject duplicate label-sync targets. Includes manifest checks, Shell/Python validation, and no policy behavior changes beyond fail-closed duplicate handling. Derek-only commits; no secrets accessed.

[greptile-apps]

Greptile Summary

This PR adds credential-free CI validation for governance sources and duplicate label-sync targets while fixing quoted label-name parsing.

• Adds a validation workflow for Python sources, shell syntax, repository manifests, and label-sync regression tests.
• Rejects duplicate synchronization targets before performing label operations.
• Makes the label-sync script sourceable and verifies parsing of a quoted label name.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/validate.yml	Adds a read-only workflow that validates governance scripts, manifests, shell syntax, and the label parser regression test.
scripts/sync-labels.sh	Rejects duplicate targets, fixes whitespace-sensitive quote removal for label names, and guards direct execution so functions can be tested safely.
scripts/test-sync-labels.sh	Adds a focused regression test confirming that a quoted label name containing spaces and a colon is decoded correctly.
scripts/tests/quoted-label.yml	Provides the quoted-label fixture used by the new shell regression test.

_{Reviews (3): Last reviewed commit: "merge: update governance branch with mai..." | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud