diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94f0b10f..d23534e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -92,19 +92,18 @@ jobs:
           if test "$repair" -eq 1; then
             echo "mode=repair_npm" >> "$GITHUB_OUTPUT"
           elif test "$governance" -eq 1; then
-            test -n "$GOVERNANCE_COMMIT" && test -n "$GOVERNANCE_NONCE" || {
+            if test -z "$GOVERNANCE_COMMIT" || test -z "$GOVERNANCE_NONCE"; then
               echo "governance preflight requires both commit and nonce" >&2
               exit 1
-            }
+            fi
             echo "mode=governance_preflight" >> "$GITHUB_OUTPUT"
           else
-            test -n "$RECOVER_VERSION" && test -n "$RECOVER_TAG_OBJECT" && \
-              test -n "$RECOVER_COMMIT" && test -n "$RECOVER_FAILED_RUN_ID" && \
-              test -n "$RECOVER_NONCE" && \
-              test -n "$RECOVER_CONFIRMATION" || {
+            if test -z "$RECOVER_VERSION" || test -z "$RECOVER_TAG_OBJECT" || \
+              test -z "$RECOVER_COMMIT" || test -z "$RECOVER_FAILED_RUN_ID" || \
+              test -z "$RECOVER_NONCE" || test -z "$RECOVER_CONFIRMATION"; then
                 echo "release recovery requires every recovery input" >&2
                 exit 1
-              }
+            fi
             test "$RECOVER_CONFIRMATION" = "$RECOVER_VERSION" || {
               echo "release recovery confirmation must equal the exact version" >&2
               exit 1
@@ -196,10 +195,10 @@ jobs:
             echo "governance preflight cannot be combined with npm repair" >&2
             exit 1
           }
-          test -n "$PREFLIGHT_COMMIT" && test -n "$PREFLIGHT_NONCE" || {
+          if test -z "$PREFLIGHT_COMMIT" || test -z "$PREFLIGHT_NONCE"; then
             echo "governance_preflight_commit and governance_preflight_nonce are both required" >&2
             exit 1
-          }
+          fi
           case "$PREFLIGHT_COMMIT" in
             *[!0-9a-f]*)
               echo "governance_preflight_commit must be a lowercase commit SHA" >&2
@@ -451,7 +450,9 @@ jobs:
           RELEASE_VERSION: ${{ steps.target.outputs.release_version }}
           RELEASE_COMMIT: ${{ steps.target.outputs.release_commit }}
           RELEASE_TAG_OBJECT: ${{ steps.target.outputs.release_tag_object }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
       - name: Require successful CI Gate on the sealed commit
         uses: actions/github-script@v7
@@ -480,7 +481,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PREVIOUS_STABLE: ${{ steps.contract.outputs.previous_stable }}
           PREVIOUS_STABLE_COMMIT: ${{ steps.contract.outputs.previous_stable_commit }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-delivered-stable.sh "$PREVIOUS_STABLE" "$PREVIOUS_STABLE_COMMIT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-delivered-stable.sh" \
+            "$PREVIOUS_STABLE" "$PREVIOUS_STABLE_COMMIT"
 
       - name: Require release governance token
         env:
@@ -625,7 +628,9 @@ jobs:
       - name: Verify sealed tag before executing release source
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
       - name: Revalidate contract and render release notes
         run: |
@@ -739,7 +744,9 @@ jobs:
       - name: Reverify remote tag before sealing GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
       - name: Preserve finalized distribution files
         uses: actions/upload-artifact@v4
@@ -816,7 +823,9 @@ jobs:
       - name: Verify sealed tag before executing publication source
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
       - name: Revalidate contract and render release notes
         run: |
@@ -859,7 +868,9 @@ jobs:
       - name: Reverify remote tag before sealing GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
       - name: Publish or reuse immutable GitHub Release
         env:
@@ -1050,7 +1061,9 @@ jobs:
       - name: Verify sealed tag before executing channel source
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: $GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
+        run: |
+          "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
+            "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
       - name: Revalidate sealed contract
         run: |