test: assert reportStep present before extractBlockquotes (CR #2918)

Two existing tests called extractBlockquotes(reportStep) without first
asserting reportStep was non-null. If the workflow file ever loses its
`<step name="report">` block, the test would fail with a confusing
TypeError on the destructuring inside extractBlockquotes instead of a
clear "report step must exist" assertion.

Add assert.ok(reportStep, ...) guards at the two missing call sites
(lines 100 and 130). The other two call sites (lines 75-83) already
had guards.

Addresses CodeRabbit comment on PR #2918.

tests/bug-2912-progress-context-authority.test.cjs

@@ -98,6 +98,7 @@ describe('#2912: progress report step has explicit context-authority directive',
   test('context-authority directive names PROJECT.md, STATE.md, and ROADMAP.md as authoritative', () => {
     const workflow = fs.readFileSync(WORKFLOW_PATH, 'utf8');
     const reportStep = extractStep(workflow, 'report');
+    assert.ok(reportStep, 'report step must exist');
     const blockquotes = extractBlockquotes(reportStep);
     const authorityBlock = blockquotes.find((b) => /context\s+authority/i.test(b));
     assert.ok(authorityBlock, 'authority blockquote must exist');
@@ -127,6 +128,7 @@ describe('#2912: progress report step has explicit context-authority directive',
   test('context-authority directive forbids using CLAUDE.md project block as a source', () => {
     const workflow = fs.readFileSync(WORKFLOW_PATH, 'utf8');
     const reportStep = extractStep(workflow, 'report');
+    assert.ok(reportStep, 'report step must exist');
     const blockquotes = extractBlockquotes(reportStep);
     const authorityBlock = blockquotes.find((b) => /context\s+authority/i.test(b));
     assert.ok(authorityBlock, 'authority blockquote must exist');