fix(registries): deny generic domain labels in Verified owner matching

[Dumbris]

Deny the generic domain labels labs, tools, mcp, dev, app and ai when matching a reverse-DNS namespace owner against a GitHub owner, so a registry entry cannot earn the Verified badge from a generic label alone.

Items

• 1466-8 (Verified-badge spoofing). Approved decision: deny-list the generic labels labs, tools, mcp, dev, app and ai in the owner token/affix matching. Change: domainLabelMatchesOwner in internal/registries rejects those labels. Test: table test of owner-matching rows in internal/registries.

Skipped

None.

Review Status

Clean after 1 round(s). Unresolved findings:

• glm:1.F1.2 (low, low-deferred): three of the ten test rows cannot fail if the deny-list regresses, so the "dev" and "ai" entries have no effective coverage. (a) com.dev/x with github.com/dev_corp/x: underscore is not a valid GitHub owner character, so GitHubRepoKey rejects the URL before domainLabelMatchesOwner runs. (b) com.ai with acme-ai: the len<3 floor returns false first. (c) com.app with myapp: there is no "app" token and the affix rule needs len>=5, so it is false even without the deny-list.

Refs #1466

[cloudflare-workers-and-pages]

Deploying mcpproxy-docs with    Cloudflare Pages

Latest commit:	295e6ba
Status:	✅  Deploy successful!
Preview URL:	https://13488821.mcpproxy-docs.pages.dev
Branch Preview URL:	https://fix-issues-w2b6-backend-inte.mcpproxy-docs.pages.dev

View logs

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!