I found something relevant buried in the depths of JO 7340.2 on contractions (i.e. abbreviations) for airlines, aircraft types etc. Section 1-4-2 says:
The company designator, together with a flight number, serves as the
aircraft identification in the ATC system. Company designators are
valid only for company business in accordance with the provisions of
its operating certificate or servicing organization. Pilots will use
standard identification procedures for personal flying
Compare that to the quote from your safety organization:
commercial flights are always conducted under a flight number, and
private operations (e.g. repositioning flights) are always conducted
under the aircraft registration number.
If you remove the words "e.g. repositioning flights" then it's saying almost exactly the same thing. What's really odd is that the checklist uses repositioning as an example of a "private operation" (the JO uses the words "personal flying", which has different connotations). I think most people would say repositioning is definitely company business. Perhaps it's just sloppy wording or a poorly chosen example.
As for the safety organization's claim that there are specific requirements in 8900.1, I couldn't find anything. The only vaguely similar thing I found is the 'use it or lose it' clause in 2-275:
B. Failure to Use Three-Letter Company Designator and Telephony
Designator. ATO AJV-2 will place on a watch list any company that does
not use an assigned three-letter company designator and telephony
designator for 2 years on an instrument flight rules (IFR) flight plan
in U.S.-controlled airspace. ATO AJV-2 will revoke and release any
three-letter company designator and telephony designator that are not
used for 3 years on an IFR flight plan in U.S.-controlled airspace.
Whoever wrote your checklist might be saying that you need to make sure that you're using your company call sign regularly to make sure you don't have it revoked, but that seems like a real stretch to me. And even if that is the case, it wouldn't explain why repositioning flights should be different. Since 8900.1 is a very large reference library, I'd ask the safety guys to point you to the exact document and wording.
Looking in the other usual sources (FARs, AIM, P/CG, ATC orders etc.) that you and Ron mentioned, I couldn't find any specific legal or regulatory requirements either. Almost every reference in FAA sources says "registration or call sign" or something similar (e.g. the AIM's instructions on filing flight plans), and the FCC regulations allow either in radio use (47 CFR 87.107).