fix(framework/tools): self-review fixes from defect survey (#546)

Two defects an independent survey of the tooling surface found in the new
helpers, fixed pre-gate:

- lane-brief.sh: label filter used jq contains() (substring) — `-l security`
  wrongly matched label `domain/6-security`. Now exact-token match against
  tea's space-separated labels string. Verified live: `-l security` -> 0,
  `-l domain/6-security` -> the real holders.
- ci-wait.sh: unknown owner silently defaulted to the `usc` Woodpecker
  instance (wrong credentials, wrong pipelines). Now fails hard requiring
  `-a <instance>`, matching lane-brief's FATAL-on-unresolved behavior.

Verified: usc owner still infers and exits 0; unknown owner exits 2 with
guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kt2D8TsnDwhtzEAPijsNmR

packages/mosaic/framework/tools/git/lane-brief.sh

@@ -76,11 +76,14 @@ echo "LANE BRIEF — $filt · $ts (login=$LOGIN)"
 echo "(open issues only; closed are excluded by definition — that's the point)"
 echo
 
+# Label match is exact-token against tea's space-separated labels string (so -l
+# "security" does NOT match label "domain/6-security"). Caveat: label names that
+# themselves contain spaces aren't distinguishable in tea's string form.
 printf '%s' "$ISSUES_JSON" | jq -r --arg ms "$MILESTONE" --arg lb "$LABEL" --arg prs "$PR_ISSUE_REFS" '
   ($prs | split("\n") | map(select(length>0))) as $prrefs
   | map(
       select( ($ms=="" or .milestone==$ms)
-          and ($lb=="" or ((.labels//"") | contains($lb))) )
+          and ($lb=="" or ((.labels//"") | split(" ") | index($lb) != null)) )
       | . + { assigned: ((.assignees//"")|length>0),
               haspr: (.index as $ix | ($prrefs | index($ix)) != null) }
     )