- `labels-reconcile` — grant callers private-repo check reads and warn when an entire PR sweep is blind (#95).