feat(labels): sync user labels via reconcile

[TrevorBasinger]

Adds roar label sync using GLaaS label reconciliation and fixes the remote lineage identity used during sync.

Summary:

• Adds GlaasClient.reconcile_labels() for POST /api/v1/labels/reconcile.
• Implements roar label sync for the active/current local lineage and explicit label targets.
• Requires authentication for user-facing sync.
• Falls back to authenticated public-lineage sync when no repo binding exists.
• Sends artifact labels with session_hash + artifact_hash.
• Strips reserved/system labels before user-label sync.
• Persists finalized GLaaS publication mapping after registration:
  • finalized remote session hash
  • prepared/canonical session hash
  • local job UID → remote job UID map
• Uses persisted publication mapping for later roar label sync.
• Shows a clear local error when syncing an unpublished lineage.
• Preserves real GLaaS 404 Session not found errors instead of misreporting them as missing endpoint support.

[christophergeyer]

👍 👍
🚢 it!