Fix provider-specific legal-source release gates

[ranade-oss]

Summary

• Treat A2AJ as optional for the aggregate live-source gate.
• Keep Ontario e-Laws and Justice Laws fail-closed as required providers.
• Accept both the e-Laws human-facing and official API URL shapes returned by A2AJ discovery.
• Retry transient live-source HTTP and e-Laws invalid-payload responses with bounded backoff.
• Preserve sanitized observation data and provider states in the release ledger before failing rehearsal.
• Upload the scheduled sanitized observation even when the observer exits nonzero.
• Add regressions for optional degradation, bounded retries, failed rehearsal ledger capture, and artifact behavior.

Verification

• Live observer: healthy with A2AJ optional, e-Laws and Justice Laws required.
• 12 operations tests passed.
• 16 evaluation tests passed.
• 7 final-gate tests passed.
• 157 baseline tests passed.
• Workflow, public-content, release-manifest, and toolchain checks passed.
• Local dependency-backed lint/build/audit could not run because the isolated runner received corrupted npm registry tarballs; GitHub Baseline is the authoritative clean-runner gate.

Production deployment is intentionally unchanged.

[ranade-oss]

Exact-head Baseline run Open-Legal-Products#238 completed on f9717bd.

Passed: frontend build, website build/lint/routes, backend tests/build, workflow validation, and all 157 repository tests.

Blocked: Governance and release checks failed only in audit:high because the current mainline workspace locks report high advisories in fast-uri, ip-address, @eslint/config-array, @eslint/eslintrc, brace-expansion, eslint, minimatch, undici, and ajv. This is pre-existing dependency state outside the legal-source patch, so the PR remains draft and unmerged under the fail-closed release rule. Production was not touched.