Fix release source-report argument

[ranade-oss]

What changed

• Replaced the multiline escaped final:check invocation with one unambiguous shell command.
• Tightened the release-train regression test to require that exact executable workflow line.
• Regenerated the governed release manifest.

Root cause

GitHub Actions folded the prior YAML command into npm run final:check -- \\ --source-report .... The escaped space produced a malformed flag with a leading space, so check-final-completion.mjs did not recognize --source-report and fell back to the stale committed July report.

Impact

Production qualification will now pass the freshly generated legal-source report to final:check. The fail-closed legal-source and release-readiness gates are unchanged. Public promotion remains explicit and is not triggered by this PR.

Validation

• npm run check passed uninterrupted
• 166/166 baseline tests
• 19/19 backend chat/provider tests
• 43/43 backend legal-source tests
• 28/28 backend security tests
• 13/13 website route tests
• Backend, frontend, and website production builds
• High-severity dependency audit
• Frontend inherited lint baseline preserved; website lint clean
• Release manifest verification