Pass finished goods as list to subcontracting BOM lookup

Function received a `set` but only handled `str` and `list`, causing SQL query failure outside request/test contexts.