Ships the opt-in label gate and the maintenance work that landed after 0.1.2.
New: requireLabel. When set, only pull requests carrying that label are reviewed; everything else is skipped as label-missing with an actionable reason and no comment. Off by default (requireLabel: null), so existing behaviour is unchanged. The skip label still wins over the opt-in label. Gate order is label-skip then label-missing then fork-pr.
Changed. GitHub Action and CI use actions/checkout@v7 and actions/setup-node@v7. The action-manifest test accepts any actions/setup-node@vN major, so Dependabot bumps no longer fail a hardcoded pin. Dev toolchain is TypeScript 7 and @types/node 26; the committed dist/ was rebuilt to match. Dependabot weekly grouped npm updates and monthly action updates are on, and the release procedure lives in AGENTS.md.
70 tests passing. Use twoimo/codex-meter@v1 to track the major release.