labels.yml is never validated before it reaches main

[vitali87]

Problem

.github/labels.yml is never validated before it reaches main.

.github/workflows/label-sync.yml triggers on:

on:
  push:
    branches: [main]
    paths: [".github/labels.yml", ".github/workflows/label-sync.yml"]
  workflow_dispatch:
  schedule: [{cron: "0 0 * * 1"}]

There is no pull_request trigger, so the manifest is only ever parsed after a change lands. A malformed entry (bad YAML, duplicate name, invalid colour) fails on main rather than on the PR that introduced it, and the PR author sees nothing.

This is a fail-open shape: the validation exists, but it runs where it cannot block what it validates.

Suggested fix

A pre-commit hook (or a pull_request-triggered job with the same paths filter) that parses the manifest and asserts:

• valid YAML, list-of-mappings shape
• every entry has name, color, description
• name values are unique
• color matches ^[0-9a-f]{6}$ (no leading #)

Related nit

claimed is currently color: B60205, the only uppercase hex among the 23 entries. GitHub preserves the casing so nothing is broken today, but that is undocumented behaviour, and a lowercase-hex assertion would catch it. Worth lowercasing alongside whichever fix lands.

Context

Found while reviewing #1431 (croft-50). Filing rather than fixing because a pre-commit hook is a standing constraint on every future commit in this repo, which is the maintainer's call rather than a drive-by.