Description

PTD support for the session label injection feature. See posit-dev/team-operator#123 for the full solution description.

Changes in this repo:

• team_operator.py: auto-enables the controller in Helm when any site's site.yaml has spec.workbench.sessionLabels configured — no manual flag needed
• aws_workload_helm.py / azure_workload_helm.py: adds user-group-* to the kube-state-metrics metricLabelsAllowlist so injected labels are exposed as Prometheus metrics
• docs/CONFIGURATION.md: sessionLabels schema reference
• docs/team-operator/README.md: usage guide
• Justfile: fix symlink-binaries to skip binaries already in .local/bin (prevents circular symlinks); add codesign step after CLI build for macOS

Category of change

• New feature (non-breaking change which adds functionality)

Checklist

• I have reviewed my own diff and added inline comments on lines I want reviewers to focus on or that I am uncertain about