Fix the safety gate for an urgent BGP push

Your network has a routing leak, and an engineer used an AI agent to write the BGP route policy change that stops it. A bad route policy can black-hole traffic for millions of subscribers, so every push goes through a change safety gate first. The on-call engineer wants the fix out now.

An assistant wrote approve_bgp_push(pop_names, subscriber_counts, human_signoff, lab_validated, rollback_timer_seconds, incident_active), the gate. It is in the editor. It has a bug. Find it and fix it.

Input and output:

• pop_names and subscriber_counts: the points of presence (PoPs, the router sites) the change can go to, and how many subscribers each one serves, at the same index.
• human_signoff: a network engineer who knows the topology approved the change.
• lab_validated: the change passed a lab or simulator run.
• rollback_timer_seconds: the commit-confirm timer. If nobody confirms the change in time, the router reverts it.
• incident_active: an incident is open.
• Return one string: a block reason, or the PoP to push to first.

Rules the tests check. Check in this order and return the first that applies:

1. No human sign-off: block:no_human_signoff.
2. Not lab validated: block:not_lab_validated.
3. The timer is 0 or less: block:no_auto_rollback.
4. An incident is active and the timer is over 600: block:rollback_timer_too_long.
5. No PoPs: block:no_target_pop. If the two lists differ in length, use only the first n PoPs, where n is the shorter length.
6. Otherwise canary:<pop>, naming the PoP with the fewest subscribers. On a tie, pick the name that comes first in plain string comparison.