What are the FAA requirements for when to use an airline call sign & flight number versus the aircraft registration number?
I found something relevant buried in the depths of JO 7340.2 on contractions (i.e. abbreviations) for airlines, aircraft types etc. Section 1-4-2 says:


  The company designator, together with a flight number, serves as the
  aircraft identification in the ATC system. Company designators are
  valid only for company business in accordance with the provisions of
  its operating certificate or servicing organization. Pilots will use
  standard identification procedures for personal flying


Compare that to the quote from your safety organization:


  commercial flights are always conducted under a flight number, and
  private operations (e.g. repositioning flights) are always conducted
  under the aircraft registration number.


If you remove the words "e.g. repositioning flights" then it's saying almost exactly the same thing. What's really odd is that the checklist uses repositioning as an example of a "private operation" (the JO uses the words "personal flying", which has different connotations). I think most people would say repositioning is definitely company business. Perhaps it's just sloppy wording or a poorly chosen example.

As for the safety organization's claim that there are specific requirements in 8900.1, I couldn't find anything. The only vaguely similar thing I found is the 'use it or lose it' clause in 2-275:


  B.    Failure to Use Three-Letter Company Designator and Telephony
  Designator. ATO AJV-2 will place on a watch list any company that does
  not use an assigned three-letter company designator and telephony
  designator for 2 years on an instrument flight rules (IFR) flight plan
  in U.S.-controlled airspace. ATO AJV-2 will revoke and release any
  three-letter company designator and telephony designator that are not
  used for 3 years on an IFR flight plan in U.S.-controlled airspace.


Whoever wrote your checklist might be saying that you need to make sure that you're using your company call sign regularly to make sure you don't have it revoked, but that seems like a real stretch to me. And even if that is the case, it wouldn't explain why repositioning flights should be different. Since 8900.1 is a very large reference library, I'd ask the safety guys to point you to the exact document and wording.

Looking in the other usual sources (FARs, AIM, P/CG, ATC orders etc.) that you and Ron mentioned, I couldn't find any specific legal or regulatory requirements either. Almost every reference in FAA sources says "registration or call sign" or something similar (e.g. the AIM's instructions on filing flight plans), and the FCC regulations allow either in radio use (47 CFR 87.107).