fix(js-bazel): enforce capability runner labels

[Jess Sullivan (Jesssullivan)]

Summary

• require shared/repo_owned js-bazel-package runner labels to include a Tinyland capability-class label
• clarify that repo_owned is a repo/owner-scoped registration and trust boundary, not repo-shaped workflow labels
• add a repo-local runner-contract check and wire it into just check

Validation

• python3 scripts/validate-ci-templates.py js-bazel-runner-contract
• ruby -e 'require "yaml"; Dir[".github/**/*.{yml,yaml}"].sort.each { |f| YAML.load_file(f); puts "yaml ok: #{f}" }'
• actionlint .github/workflows/js-bazel-package.yml
• python3 -m py_compile scripts/validate-ci-templates.py
• git diff --check
• nix develop --command just check

TIN-1630