docs: document workspace and provider label capabilities #4250

User Story

When consulting OpenShell documentation to understand which objects support labels, I found that workspace labels are missing and provider label authoring is unexplained. I need documented examples and API limitations so I can use the existing label support without reading implementation code.

Description

Document the existing label capabilities for workspaces and providers. Add workspace creation, inspection, and selector examples. Explain how API clients set provider labels and clarify the CLI and filtering limitations.

Context

• Workspace creation accepts repeated --label KEY=VALUE; listing accepts --label-selector key=value,key2=value2; workspace get displays labels.
• Provider creation accepts provider.metadata.labels through the API and persists them. The provider docs mention labels in structured output but do not explain authoring. The CLI has no provider label flag and ListProviders has no label selector.
• Sandbox and sandbox workload template labels already have documented examples.
• Internal labels on service endpoints are outside this task's scope.

Definition of Done

• Workspace docs explain creation, inspection, filtering, and the absence of a label update operation.
• Provider docs show the label field used by API creation and clarify CLI/filtering limitations.
• Examples match current CLI and public protobuf contracts.
• Documentation validation and applicable formatting checks pass.