Every now and then a trainee adds the "Complete" label themselves.
This can't be prevented by permissions on GitHub - labels are all or nothing.
But the PR Metadata Validator runs on every label change. We could in theory, when "Complete" is added, check if the user who took the action is (transitively) in the "Mentors" team, and remove the label (with a comment) if they're not.