fix(infra): infraRunning must match the canonical container name

auth-debug carries the same org.dcntrlized.service=dcntrlized-auth role label,
so the shared-auth check considered it running and skipped starting the real
hub. Match the exact container name (dcntrlized-auth) on the running
candidate; dev lookalikes sharing the role label no longer satisfy the check.

src/lib/containers/infra.go

@@ -18,6 +18,7 @@ package containers
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/docker"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
@@ -117,8 +118,16 @@ func infraRunning(ctx context.Context, dc *docker.DockerClient, serviceName stri
 		return false
 	}
 	for _, c := range containers {
-		if c.State == "running" || c.State == "restarting" {
-			return true
+		if c.State != "running" && c.State != "restarting" {
+			continue
+		}
+		// Only the canonical container (e.g. "dcntrlized-auth") counts as the
+		// shared infrastructure being up. Dev lookalikes (auth-debug) share the
+		// role label but must never satisfy the check.
+		for _, n := range c.Names {
+			if strings.TrimPrefix(n, "/") == serviceName {
+				return true
+			}
 		}
 	}
 	return false