feat(capability-requests): add routing_note, PATCH endpoint, word-boundary fix, and ops-bridge tunnel targets

- Add `routing_note` column (migration l9g0h1i2j3k4) to persist why a request was routed to a given domain
- Fix substring-match bug in `_route_capability`: use `\b` word-boundary regex so 'postgres' no longer matches inside 'postgresql'
- Include `title` in keyword scoring for better routing accuracy
- Return `routing_note` string from `_route_capability` and store it on the request
- Add `PATCH /capability-requests/{id}` endpoint + `CapabilityRequestPatch` schema to correct mutable metadata (catalog_entry_id, priority, blocking_task_id, fulfilling_workstream_id)
- Add `patch_capability_request` MCP tool wrapping the new endpoint
- Add 105 lines of routing tests (word-boundary, title-match, multi-entry scoring, broadcast fallback)
- Add `tunnels-up`, `tunnels-status`, `tunnels-check` Makefile targets for ops-bridge managed tunnels

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

mcp_server/server.py

@@ -1881,6 +1881,46 @@ def update_capability_request_status(
     return json.dumps(result, indent=2)
 
 
+@mcp.tool()
+def patch_capability_request(
+    request_id: str,
+    catalog_entry_id: Optional[str] = None,
+    priority: Optional[str] = None,
+    blocking_task_id: Optional[str] = None,
+    fulfilling_workstream_id: Optional[str] = None,
+) -> dict:
+    """Correct mutable metadata on a capability request.
+
+    Correcting catalog_entry_id automatically re-derives the fulfilling domain.
+    Use this when the hub mis-routed a request (wrong catalog entry or domain).
+    Only provided (non-None) fields are updated.
+
+    Args:
+        request_id: UUID of the capability request to patch.
+        catalog_entry_id: Correct catalog entry UUID. Re-derives fulfilling domain.
+        priority: New priority (low/medium/high/critical).
+        blocking_task_id: UUID of the task this request unblocks on completion.
+        fulfilling_workstream_id: UUID of the workstream delivering this capability.
+
+    Returns:
+        Updated capability request dict, or {"error": "..."}.
+    """
+    body: dict = {}
+    if catalog_entry_id is not None:
+        body["catalog_entry_id"] = catalog_entry_id
+    if priority is not None:
+        body["priority"] = priority
+    if blocking_task_id is not None:
+        body["blocking_task_id"] = blocking_task_id
+    if fulfilling_workstream_id is not None:
+        body["fulfilling_workstream_id"] = fulfilling_workstream_id
+
+    if not body:
+        return {"error": "no fields provided to patch"}
+
+    return json.dumps(_patch(f"/capability-requests/{request_id}", body), indent=2)
+
+
 @mcp.tool()
 def list_capability_requests(
     domain: str | None = None,