Function label_selector 

pub fn label_selector<K, V, M>(labels: M) -> Value
where
    M: IntoIterator<Item = (K, V)>,
    K: Into<String>,
    V: Into<String>,

Wrap a typed string-valued label mapping in the canonical K8s LabelSelector shape — {matchLabels: <string-string-map>} — and return it as a serde_yaml::Value::Mapping ready to drop directly under any K8s field that takes a label selector (Cilium endpointSelector / fromEndpoints[].matchLabels, Gateway API BackendRef filters, ComputeUnit selector, Service spec.selector, the future mesh.pleme.io/v1alpha1/Aplicacao CR spec.selector).

Lifted from two inline serde_yaml::Mapping::new() + insert(Value::String("matchLabels".into()), yaml_string_mapping(_)) blocks in caixa-mesh::cilium_network_policies (the destination endpointSelector and the source fromEndpoints[0] selector) so the next renderer to land — the per-:politicas CiliumClusterwideEnvoyConfig emitter (MESH-COMPOSITION §III.2 #3), the app-operator’s typed mesh.pleme.io/v1alpha1/Aplicacao CR materializer (§III.2 #5), the M4 cross-cluster fan-out’s per-cluster Service/HTTPRoute backendRefs selectors, the future caixa-otel OpenTelemetry-Collector resource-selector pipeline — gets the canonical K8s label-selector shape for free with one function call, instead of re-inlining the same four-line Mapping::new() + insert("matchLabels", yaml_string_mapping(_)) boilerplate.

V0 emits the equality-based selector axis only (matchLabels); the set-based axis (matchExpressions) is deliberately out of scope. A future :contratos axis whose selector needs matchExpressions (e.g. In, NotIn, Exists, DoesNotExist operators against a label key) is a future struct-shaped extension of this helper — e.g. a richer [LabelSelector] view type with match_labels + match_expressions fields — not a per-renderer rewrite of every selector emission site.

Iteration order is whatever the input iterator yields; pass a BTreeMap for alphabetical determinism (THEORY.md §V.2.7 render determinism: rendered YAML key order is independent of source-code declaration order). The two pleme-io selector helpers (pleme_program_selector / pleme_program_in_aplicacao_selector) already return BTreeMaps for exactly this reason, so a label_selector(pleme_program_in_aplicacao_selector(_, _)) call renders deterministically end-to-end.