Cohort previews should scan IDs only and freeze reproducibility metadata

Observation (2026-09-06 UTC, source: ender-inference COR-4065 / PR #140 implementation and targeted tests): for privacy-preserving evaluator cohorts, select only call ID plus cursor metadata from Supabase; apply allowlisted filters; keyset-page by (ended_at, id); and emit a canonical manifest containing filters, SHA-256 rank sampling method/seed, resolved IDs, and digest. Validate sampling before remote discovery and require endpoint authentication so exact call IDs are not anonymously enumerable.