check_runner_labels.sh matches comments and substrings, not label tokens #5247

scripts/check_runner_labels.sh matches its discriminating-label pattern against the whole runs-on: line, including any trailing # comment. A self-hosted job with no discriminating label still passes if its comment contains one of the words.

Found on #5229. At 838321f, the mutants job in .github/workflows/mutants-nightly.yml is:

runs-on: [self-hosted, Linux, X64, mutants] # #5228: ... never the ARM64 gpu runner ...

mutants is not in DISCRIM, yet the guard passes this job because the comment contains gpu. The same selector without the comment fails the guard; that is exactly the stop job's failure on 4c08aa3.

Unanchored substrings make the same mistake inside the label list: gpu matches not-gpu, and m4 matches xm4y.

Fix: strip the trailing comment, split the bracketed list into label tokens, and match each token whole (case-insensitive, as GitHub matches labels). Add a must-FAIL / must-PASS case table and a --self-test that runs it, including:

• the comment-only case above (must FAIL);
• a near-miss label (must FAIL);
• each real pool (must PASS).

Owner: la-0.71.

keep-open: the issue closes with its fix PR, not by a lane.