Run fresh legal-source checks before public promotion

[ranade-oss]

What changed

• Observe Ontario e-Laws and Justice Laws immediately before the production final-completion gate when public promotion is requested.
• Pass that sanitized runtime report explicitly to final:check; local invocations still default to the committed report.
• Keep the gate fail-closed when live observation is degraded or cannot produce a report.
• Upload the production qualification report with always() so a blocked qualification remains inspectable.
• Print provider-level source and release-readiness blockers.
• Add regression coverage and update the governed release manifest.

Root cause

The release workflow ran final:check --production against the committed July legal-source report before the release-train rehearsal performed a fresh observation. The stale-report check blocked production promotion, and the later fresh probe was unreachable because qualification had already failed.

Impact

A promotion run now evaluates current legal-source health before any Fly build or production action. A real Ontario e-Laws or Justice Laws failure still blocks promotion, while the qualification artifact records the sanitized reason and provider state.

Validation

• npm run check passed uninterrupted
• 161/161 baseline tests
• 19/19 backend chat/provider tests
• 43/43 backend legal-source tests
• 28/28 backend security tests
• 13/13 website route tests
• Website build and lint
• High-severity dependency audit
• Release manifest check