fix(js-bazel): guard empty shared runner labels

[Jess Sullivan (Jesssullivan)]

Summary

• make runner_mode=shared reject an explicitly empty shared_runner_labels_json
• document that empty shared labels usually mean a missing caller repo variable
• add changelog coverage for the guard

This prevents package repos from silently falling back to the default shared tinyland-docker class when vars.PRIMARY_LINUX_RUNNER_LABELS_JSON is unset.

Validation

• actionlint .github/workflows/js-bazel-package.yml
• python3 scripts/validate-ci-templates.py internal-refs
• nix develop --command python3 scripts/validate-ci-templates.py manifest
• git diff --check