feat: label issues from non-org-members across all repos

Right now there's no way to tell at a glance whether an issue came from an org member or an external contributor across all Overture repos. Triage has to check each author manually.

Add a scheduled, org-wide job that labels newly opened issues from non-org-members. A per-repo issues: opened trigger doesn't cover repos it isn't added to, so this needs a batch job searching the org and checking membership per author, similar to how sync-project-status.yml handles cross-repo ProjectV2 work.

Needs a dedicated GitHub App (org Members: read, repo Issues: write) installed org-wide, plus the usual omf-github-terraform OIDC role/secret wiring.