hanzo-inc resolves to the KMS org it actually seals to

The owner -> KMS-org relation knew hanzoai, luxfi and zooai. hanzo-inc — pay
and the other company surfaces — fell through to the default branch and
became the literal owner, which is not a KMS org.

That was survivable by accident: the read takes its org from the TOKEN, so
the flat route still returned the right secret. What was wrong was the
fallback URL and, more expensively, every error message this step can print
— they named org=hanzo-inc, which sends whoever reads them looking for a
missing tenant rather than a missing credential.

One line, in the one place the comment above it already says this relation
belongs.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

.github/workflows/build.yml

@@ -73,7 +73,7 @@ on:
           A string sidesteps it on both planes with identical meaning, and the
           comparison is against 'false' rather than a truthiness test so that the
           expression callers already write — hanzoai/cloud's
-          `tests: ${{ github.ref_type != 'tag' }}`, which renders the strings
+          `tests:` set from `github.ref_type != 'tag'`, which renders the strings
           "true"/"false" — keeps working unchanged.
         type: string
         default: 'true'
@@ -375,6 +375,15 @@ jobs:
           if [ -z "$ORG" ]; then
             case "${{ github.repository_owner }}" in
               hanzoai) ORG=hanzo ;;
+              # hanzo-inc is the same TENANT as hanzoai — pay, commerce and the
+              # rest of the company surfaces bill and seal to KMS org `hanzo`.
+              # Without this line ORG fell through to the literal owner,
+              # "hanzo-inc", which is not a KMS org. That still LOOKED fine,
+              # because the read below takes its org from the TOKEN, not the URL
+              # — so the only things that were wrong were the fallback URL and
+              # every error message, which named an org that does not exist and
+              # sent the reader looking for a tenant instead of a credential.
+              hanzo-inc) ORG=hanzo ;;
               luxfi)   ORG=lux ;;
               zooai)   ORG=zoo ;;
               *)       ORG="${{ github.repository_owner }}" ;;

.hanzo/workflows/build.yml

@@ -73,7 +73,7 @@ on:
           A string sidesteps it on both planes with identical meaning, and the
           comparison is against 'false' rather than a truthiness test so that the
           expression callers already write — hanzoai/cloud's
-          `tests: ${{ github.ref_type != 'tag' }}`, which renders the strings
+          `tests:` set from `github.ref_type != 'tag'`, which renders the strings
           "true"/"false" — keeps working unchanged.
         type: string
         default: 'true'
@@ -375,6 +375,15 @@ jobs:
           if [ -z "$ORG" ]; then
             case "${{ github.repository_owner }}" in
               hanzoai) ORG=hanzo ;;
+              # hanzo-inc is the same TENANT as hanzoai — pay, commerce and the
+              # rest of the company surfaces bill and seal to KMS org `hanzo`.
+              # Without this line ORG fell through to the literal owner,
+              # "hanzo-inc", which is not a KMS org. That still LOOKED fine,
+              # because the read below takes its org from the TOKEN, not the URL
+              # — so the only things that were wrong were the fallback URL and
+              # every error message, which named an org that does not exist and
+              # sent the reader looking for a tenant instead of a credential.
+              hanzo-inc) ORG=hanzo ;;
               luxfi)   ORG=lux ;;
               zooai)   ORG=zoo ;;
               *)       ORG="${{ github.repository_owner }}" ;;