Two defects an independent survey of the tooling surface found in the new
helpers, fixed pre-gate:
- lane-brief.sh: label filter used jq contains() (substring) — `-l security`
wrongly matched label `domain/6-security`. Now exact-token match against
tea's space-separated labels string. Verified live: `-l security` -> 0,
`-l domain/6-security` -> the real holders.
- ci-wait.sh: unknown owner silently defaulted to the `usc` Woodpecker
instance (wrong credentials, wrong pipelines). Now fails hard requiring
`-a <instance>`, matching lane-brief's FATAL-on-unresolved behavior.
Verified: usc owner still infers and exits 0; unknown owner exits 2 with
guidance.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kt2D8TsnDwhtzEAPijsNmR
46d828f166