fix(framework/tools): self-review fixes from defect survey (#546)

Two defects an independent survey of the tooling surface found in the new
helpers, fixed pre-gate:

- lane-brief.sh: label filter used jq contains() (substring) — `-l security`
  wrongly matched label `domain/6-security`. Now exact-token match against
  tea's space-separated labels string. Verified live: `-l security` -> 0,
  `-l domain/6-security` -> the real holders.
- ci-wait.sh: unknown owner silently defaulted to the `usc` Woodpecker
  instance (wrong credentials, wrong pipelines). Now fails hard requiring
  `-a <instance>`, matching lane-brief's FATAL-on-unresolved behavior.

Verified: usc owner still infers and exits 0; unknown owner exits 2 with
guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kt2D8TsnDwhtzEAPijsNmR

packages/mosaic/framework/tools/woodpecker/ci-wait.sh

@@ -49,7 +49,7 @@ if [[ -z "$INSTANCE" ]]; then
   case "${REPO%%/*}" in
     usc|USC) INSTANCE=usc ;;
     mosaicstack|mosaic) INSTANCE=mosaic ;;
-    *) INSTANCE=usc ;;
+    *) echo "FATAL: cannot infer Woodpecker instance for owner '${REPO%%/*}' — pass -a <instance>" >&2; exit 2 ;;
   esac
 fi