diff --git a/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs b/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs
index 01a5abc5..2a340ffd 100644
--- a/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs
+++ b/scripts/native/hwlab/runtime-pipeline-resource-governance.mjs
@@ -49,7 +49,9 @@ function applyPipelineBuildQueue(doc) {
     'build_service() {',
     '  service_id="$1"',
     '  mkdir -p "/workspace/service-work/$service_id" "/workspace/service-results-tekton/$service_id"',
-    workerScript.split('\n').map((line) => `  ${line}`).join('\n'),
+    // Keep the worker body at column zero: POSIX heredoc terminators in the
+    // generated publish script must not be indented by the function wrapper.
+    workerScript,
     '}',
     `max_parallel=${maxParallel}`,
     'service_csv="$(params.services)"',
diff --git a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts
index 349c3975..acf983f3 100644
--- a/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts
+++ b/scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts
@@ -282,6 +282,18 @@ test("PaC automatic webhook disable is target-scoped and does not touch Kubernet
   expect(action).not.toContain("ensure_webhook");
 });
 
+test("PaC top-level help enumerates every exposed manual-release control", async () => {
+  const help = await runPlatformInfraPipelinesAsCodeCommand({} as never, ["--help"]);
+  expect(String((help as any).command)).toContain("automatic-webhooks");
+  expect(JSON.stringify(help)).toContain("automatic-webhooks disable --target <NODE> [--confirm]");
+});
+
+test("bounded HWLAB build worker wrapper preserves heredoc terminators", () => {
+  const source = readFileSync(resolve(import.meta.dir, "../native/hwlab/runtime-pipeline-resource-governance.mjs"), "utf8");
+  expect(source).toContain("workerScript,");
+  expect(source).not.toContain("workerScript.split('\\n').map((line) => `  ${line}`).join('\\n')");
+});
+
 test("L2/L3 release exposes plan first and trigger only sends the PaC webhook", async () => {
   await expect(runPlatformInfraPipelinesAsCodeCommand({} as never, [
     "release", "trigger", "--target", "NC01", "--consumer", "hwlab-nc01-v03",
diff --git a/scripts/src/platform-infra-pipelines-as-code.ts b/scripts/src/platform-infra-pipelines-as-code.ts
index 43df3ba4..af37b0e0 100644
--- a/scripts/src/platform-infra-pipelines-as-code.ts
+++ b/scripts/src/platform-infra-pipelines-as-code.ts
@@ -617,7 +617,7 @@ function help(scope: string | null): Record<string, unknown> {
     };
   }
   return {
-    command: "platform-infra pipelines-as-code plan|release|status|history|diagnose-regression|delivery-timing|delivery-observe|debug-step|source-artifact",
+    command: "platform-infra pipelines-as-code plan|release|automatic-webhooks|status|history|diagnose-regression|delivery-timing|delivery-observe|debug-step|source-artifact",
     configTruth: configLabel,
     usage: [
       "bun scripts/cli.ts platform-infra pipelines-as-code plan --target JD01",