dependency-gap(phase-1-cicd-setup): PR-label gate generated without provisioning the label vocabulary; label set should be org-configurable

## Summary

`phase-1-cicd-setup` (and/or the pr-validation workflow template it emits) generates a **PR Label Requirements gate** that hard-fails any PR whose labels aren't in a fixed vocabulary — but the factory never **provisions** that vocabulary as repo labels, and the vocabulary itself is **hardcoded** rather than sourced from project/org config.

This is distinct from #292 (which is about *applying* a label at create time). This issue is about (a) the gate referencing labels that **don't exist in the repo**, and (b) the vocabulary being **non-configurable**.

## Observed (private Godot pilot)

The emitted `pr-validation.yml` gated on a fixed 7-label set:
```
ALLOWED_LABELS="feature fix chore refactor docs test release"
REQUIRE_LABELS="feature fix"
EXEMPT_LABELS="chore docs refactor release test"
```
At gate-activation time only **3 of the 7** labels existed in the repo (GitHub's defaults). The other 4 (`fix`, `refactor`, `test`, `release`) had to be created by hand with `gh label create` before any PR could satisfy the gate — even a *correctly* labeled PR would be unmergeable because the label literally didn't exist to apply.

## Three defect classes (as observed)

1. **Dependency gap:** the gate depends on a label vocabulary that setup never creates. cicd-setup should `gh label create` (idempotently) every label it gates on, as part of the same step that writes the gate.
2. **Analysis gap:** nothing verifies *gate-vocabulary ⊆ repo-labels* before the gate goes live. A preflight assertion would catch the mismatch at setup time instead of at first-PR time.
3. **Configurability gap:** the vocabulary is hardcoded in the template. Many orgs maintain their own label taxonomy (priority/area/type schemes, semantic-release labels, etc.) and routinely re-map these to org standards. The gated set should come from a project config key (e.g. `labels:` in the factory config) with the current 7 as the default, so adopting a project doesn't force the factory's taxonomy onto an existing repo.

## Suggested fix

- cicd-setup reads the label vocabulary from project config (default = current 7).
- Same step idempotently creates each gated label (`gh label create --force`).
- Add a setup-time assertion: every label in `REQUIRE/ALLOWED/EXEMPT` exists as a repo label; fail setup loudly if not.
- Cross-link #292 (apply-at-create) — together these make the label gate self-consistent end to end.

## Scope note
Reported from a private downstream pilot; this filing is framework-pattern + reproduction only, no product content.