cc-stale label-ensure resilience

The Step 3c sweep died (exit 1) on a busy cron tick at the gh label list stage. Pick a failure mode; compare the old fragile check vs the new ensure_label().