fix(git-tools): sanitize WP5b for the public-package gates (review identity scrub + tool index)

verify-sanitized denylist: an operator-identity token in a ci-queue-wait
comment (spec finding references genericized - the framework-PR
firewall applies to shipped files). check-tools-index: repo-decl.sh
shipped means documented in the resident index in the SAME commit, and
executable. Full sanitization CI step replayed green locally
(verify-sanitized, resident budget x2, enumeration guard, tools index
x2).

packages/mosaic/framework/tools/git/ci-queue-wait.sh

@@ -503,7 +503,7 @@ if [[ -z "$BRANCH" ]]; then
     fi
 fi
 
-# T51 WP5b (spec 4.1, C4/jarvis F8): the declaration adds ROUTE CONTEXT only.
+# T51 WP5b (spec 4.1, review ruling C4/F8): the declaration adds ROUTE CONTEXT only.
 # Branch-selection semantics are UNCHANGED — the guard keeps inspecting the
 # exact head above. No declaration dependency gates the wait (4.3/DR2 R9:
 # blocking here adds a blocker with no safety gain); absence is silent.