Add sync-label check: PRs need the maintainer-applied 'sync' label

This repo is a read-only mirror of the internal source of truth; the
only PRs that should merge are release syncs. The check fails unless
the PR carries the 'sync' label (triage+ permission to apply), so a
merge always requires a deliberate maintainer act. Temporary until
release automation takes over merging.

Signed-off-by: Hector Castejon Diaz <hector.castejon@databricks.com>

Author: hectorcast-db

.github/workflows/sync-label.yml

@@ -0,0 +1,24 @@
+# This repository is a read-only mirror; the only PRs that should
+# merge are the release sync PRs from the internal source of truth.
+# This check fails unless the PR carries the `sync` label, which only
+# maintainers can apply — making every merge a deliberate act.
+# Temporary guard until release automation takes over merging.
+name: Sync label
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+
+jobs:
+  sync-label:
+    name: sync-label
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require the `sync` label
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'sync') }}
+        run: |
+          echo "::error::This PR does not carry the 'sync' label. This repository is a read-only mirror — only release sync PRs merge here. If this IS a release sync PR, a maintainer must apply the 'sync' label; community contributions are re-applied in the internal repository instead (see CONTRIBUTING.md)."
+          exit 1
+      - name: Label present
+        if: ${{ contains(github.event.pull_request.labels.*.name, 'sync') }}
+        run: echo "sync label present — this is a release sync PR."