fix(release): forward unix provenance arguments

[kalvinnchau]

Fixes Linux and macOS release provenance generation under Ubuntu /bin/sh.

Technical changes:

• forwards the complete positional argument list with POSIX-compatible "$@" before invoking the nested Bash process
• removes the ${@:5} expansion that fails under dash
• updates the release recipe assertion to match the corrected command

Validation:

• focused Ubuntu act job generated and validated Linux and macOS provenance receipts without running application builds
• just release-scripts-test (78 tests passed)

[morgmart]

🤖 Automated code review

APPROVE. Fresh static review of exact three-dot range 6e6e19e...8f5f41d found no publishable findings. The Unix release-provenance recipe now forwards its complete positional argv through the POSIX outer shell into Bash without the dash-incompatible ${@:5} expansion, and the existing behavioral test exercises the changed recipe with spaces, a quote, and a literal dollar sign before verifying the complete receipt, so the regression coverage is discriminating rather than assertion-only. Final self-check covered the changed macOS/Linux provenance flow and unchanged Windows counterpart; accessibility, i18n, navigation, consent, and design-system rules (not applicable because there is no UI/product-surface change); synchronous failure handling plus async, never-completes, lifecycle, and race behavior; test honesty; project laws; duplicate overlap; and the evidence/user-effect bar for blocking severity. No unsupported or overlapping issue survived. Supplied GitHub evidence was inspected: all 10 captured check runs completed successfully at the exact head SHA, while the separate legacy combined status is pending with zero status contexts; required checks still govern merge readiness. Supplied review threads are empty, so there is no unresolved prior automated finding or suppression.

Deterministic publication result: 0 blocking and 0 non-blocking finding(s) publishable; 0 duplicate(s) suppressed.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.