Replace substring contains() with a regex exact-segment match so a domain whose name is a substring of another (e.g. "tag" in "tagging") cannot silently escape the predicate and produce a false negative. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>