Labels need to be part of the setup/update

[ArchonVII]

Example:
• The repo does not have a no-changelog label, and close-scan requires either that label or a .changelog/unreleased fragment for script changes.
4 - Branch: agent/codex/74-doc-health-checker

[ArchonVII]

Scheduled (owner sign-off 2026-07-01): label provisioning runs as part of the friction-arc W6 consumer backfill — one setup-repo.mjs pass per repo alongside the delivery-workflow block and validator sync, so each consumer gets a single visit. This issue closes when that pass lands.