Label sync crashes the whole run when an AP tag has no matching GitHub label

[thewrz]

Why

First production sync.py --apply after the #66 merge died mid-run:

gh issue edit failed: failed to update .../issues/110: 'ADR' not found
subprocess.CalledProcessError: Command '['gh', 'issue', 'edit', '110', '--add-label', 'ADR']' returned non-zero exit status 1

An AgilePlace card carried an ADR tag; label reconciliation planned a GitHub add; but gh issue edit --add-label does NOT create missing labels, and the target repo has no ADR label. The CalledProcessError escaped metadata_sync.sync_metadata (metadata_sync.py:111 → ghkit.edit_label → ghkit.run with check=True) uncaught and aborted the entire sync — one unknown label = full run outage. Pre-existing gap (predates #66/#79); surfaced now because a live card gained a tag the repo never defined.

Fix (maintainer decision 2026-07-23: auto-create)

1. Auto-create missing labels: when a planned --add-label fails because the label doesn't exist, gh label create <name> (dry-run gated) and retry the add once. The tag mirrors as intended — consistent with the sync's reconciliation philosophy.
2. Error boundary: a label add/remove failure must never kill the run. On unrecovered failure, WARN and treat the name as skipped with the same new_base bookkeeping _filter_gh_safe_labels already uses (skipped add → pulled from new base, retried next run; failed remove → kept in base). Mirrors the per-action boundary comment sync got in Sync GitHub issue comments <-> AgilePlace card comments #66 (P2 Make milestone-tag selection base-aware instead of lexicographic-first #7).

Testing

• Regression: missing-label add → create+retry → success path; create-also-fails → WARN + skip + base bookkeeping + run continues.
• Dry-run parity: DRY prints for the create, no network.

🤖 Diagnosed from the live production run by Claude Fable 5.