install-agent-team: pre-flight checks (labels exist, lock files compile, canary dispatch) before declaring install success

[verkyyi]

Summary

First real dispatch on verkyyi/agentfolio failed because implementer-agent.lock.yml was out of sync with the .md frontmatter — a state the installer left behind without warning (run 24679888189). Separately, required state:* labels didn't pre-exist; the agents would have failed closed had they been needed earlier. The installer today reports success once the install PR merges, but "merges" and "works" are two different things.

Proposal

/install-agent-team runs post-install (or post-merge of the install PR) pre-flight:

1. Confirm all required labels exist on the repo (agent-team, state:plan-needed, state:impl-needed, state:review-needed, state:blocked, state:done, agent-team:pr, agent-team:reviewed). Create any missing.
2. Run gh aw compile against the just-installed workflows and diff the output against the committed lock files. If drift, abort with a clear error: lock files drifted from .md — re-run the installer or 'gh aw compile'.
3. Optional: open a tiny canary issue titled [agent-team] self-test with a trivial body (e.g. "add a comment to this issue") and watch the pipeline run end-to-end, then close it. Only report "install complete" after this loop passes.

Acceptance

• Labels are auto-created if missing, not assumed.
• Lock-file drift is caught before the first real task.
• Canary (or at minimum a lock-compile check) is part of the install script.
• Installer writes an .agent-team.yml starter (ties in with sibling issue on per-repo config).