Enforce review policy independently of optional capture steps

When a credential type requires human review, derive that hold from the current credential evidence rather than a side effect produced by an optional later capture step. Otherwise a configuration that omits that step can reach automatic approval even though the usual complete-photo workflow routes correctly. Apply the review hold after required-input completion and hard-failure checks, and preserve explicit human acceptance. Test configurations both with and without the later step. This lesson concerns application review policy; it does not establish document authenticity or require every credential to use human review. Applies when: Configurable capture workflows attach policy decisions to optional downstream evidence. Keywords: credential verification review policy optional capture configuration bypass regression