test(check): escape the runs-on fixture with JSON.stringify, not a quote-only replace

CodeQL js/incomplete-sanitization (#888): the hand-rolled replace only escaped
double quotes, so a backslash in the fixture would have produced a malformed YAML
scalar. JSON.stringify covers every escape the double-quoted YAML scalar needs.

tests/unit/check-workflows-provenance-runner.test.ts

@@ -59,7 +59,7 @@ test("classifyRunsOn: hosted labels are hosted, opaque expressions are unknown (
 test("flags --provenance inside a job routed to the self-hosted pool", () => {
   const found = findProvenanceOnSelfHosted(
     workflow(
-      `"${VPS_EXPR.replace(/"/g, '\\"')}"`,
+      JSON.stringify(VPS_EXPR),
       'npm stage publish --provenance --access public --tag "$TAG"'
     ),
     "npm-publish.yml"