Add gh-prs-fix-all: fix the threatcrush-scan PRs that are ours

[ralyodio]

Wraps tcfeed check --fix (threatcrush bin/tcfeed.ts, merged in profullstack/threatcrush#111). It reads every open threatcrush-scan pull request and sorts the red into two piles by workflow path, not job name:

• ours — .github/workflows/threatcrush-scan.yml, the file those PRs add
• theirs — anything else, reported and left alone however it is invoked

gh-prs-fix-all                 # fix ours, report theirs
gh-prs-fix-all --dry-run       # change nothing, just say what stands
gh-prs-fix-all owner/name ...  # only these

Why it is a file here and not a function in ~/.zsh_aliases

This is the whole reason it belongs in this repo. The moshcode pit runs its aliases with zsh -c <command>, and zsh -c is a non-interactive shell — it reads neither ~/.zshrc nor ~/.zsh_aliases. Defined as a function it answered command not found from the pit while the identical word worked when typed at a prompt, which is a confusing way to find out:

mosh ▸ /gh-prs-fix-all
· zsh -c gh-prs-fix-all
zsh:1: command not found: gh-prs-fix-all

An executable works from an interactive shell, from zsh -c, and from the pit alike, because none of them have to have sourced anything first.

Nothing is aliased to it either — a function beats PATH, so a wrapper of the same name would silently shadow this one and the two would drift. Same reasoning is why it is not called gh-prs: that is already a different tool in this directory, and the collision would not have announced itself.

It refuses an out-of-date checkout

tcfeed reads its first argument as a post count and falls back to 50 when it is not a number. Handed check by a checkout that predates the subcommand, it would go and fetch reddit and scan ten strangers' repositories — a long, rate-limited, entirely wrong answer to "fix my pull requests". So it greps for the subcommand first and stops with instructions.

Not included

README.md has an entry for gh-prs and gh-prs-merge, so this wants one too — but the working tree already has uncommitted changes to that file (and an untracked bin/domainjson), and staging README.md here would have swept unrelated in-progress work into this commit. Left for whoever owns those changes.

🤖 Generated with Claude Code