fix: accept lesser-body boolean release flags

[aron23]

Summary

• fix the provision runner's lesser-body manifest parsing so boolean false values are accepted instead of treated as empty by jq //
• add a regression test that pins the boolean-safe buildspec logic for source_checkout_required and npm_install_required
• deploy the hotfix to lab after verification

Verification

• cd cdk && npm test -- --test-name-pattern 'lesser-body|asset-contract|boolean false manifest flags'
• jq -r 'if .deploy.source_checkout_required == false then "false" elif .deploy.source_checkout_required == true then "true" else empty end' /tmp/lesser-body-v0.2.3/lesser-body-release.json
• jq -r 'if .deploy.npm_install_required == false then "false" elif .deploy.npm_install_required == true then "true" else empty end' /tmp/lesser-body-v0.2.3/lesser-body-release.json
• bash gov-infra/verifiers/gov-verify-rubric.sh
• GOTOOLCHAIN=auto theory app up --aws-profile Lesser --stage lab --execute

Root Cause

The live lesser-body v0.2.3 release correctly publishes source_checkout_required=false and npm_install_required=false, but the runner shell used jq '.deploy.<flag> // empty'. In jq, false // empty evaluates to empty, so the runner rejected the valid manifest as if the field were missing.